openvas-scanner Documentation

This repository contains the scanner component for Greenbone Community Edition.

4,879 stars Rust Rust 322 files · ~125,124 tokens #c#foo#greenbone#greenbone-community-edition#greenbone-vulnerability-management#gvm#openvas#openvas-scanner
RAW Doc

Technical Documentation: greenbone/openvas-scanner

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`)

OpenVAS Scanner




This is the OpenVAS Scanner of the Greenbone Community Edition.

It is used for the Greenbone Enterprise appliances and is a full-featured
scan engine that executes a continuously updated and extended feed of
Vulnerability Tests (VTs).

Releases

All release files are signed with
the Greenbone Community Feed integrity key.
This gpg key can be downloaded at https://www.greenbone.net/GBCommunitySigningKey.asc
and the fingerprint is 8AE4 BE42 9B60 A59B 311C 2E73 9823 FAA6 0ED1 E580.

Installation

This module can be configured, built and installed with following commands:

text
cmake .
make install

For detailed installation requirements and instructions, please see the file
INSTALL.md. The file also contains instructions for setting up
openvas and for making the scanner available to other GVM modules.

If you are not familiar or comfortable building from source code, we recommend
that you use the Greenbone Enterprise TRIAL, a prepared virtual
machine with a readily available setup. Information regarding the virtual machine
is available at https://www.greenbone.net/en/testnow.

Rust Implementation

This repository also consists of a rust project aiming to replace the current scanner stack
(openvas-scanner, ospd-openvas, notus-scanner). It simplifies the use of the scanner and centralizes
everything needed for scanning. Currently it uses the openvas-scanner as scan engine.

Docker, [Greenbone Community Containers](https://greenbone.github.io/docs/latest/22.4/container/)

If you want to use the docker files provided in this repository you can pull them from the Greenbone registry at ghcr.io/greenbone/openvas-scanner:stable. You can also locally build them using:

text
docker build -t <image-name> -f .docker/prod.Dockerfile .

For more information about building docker images, see
official man.
We also provide a fully containerized
solution
for the Greenbone Community Edition.

Please beware: The Greenbone Community Container are currently under development.

Support

For any question on the usage of openvas please use the Greenbone
Community Portal. If you found a problem
with the software, please create an
issue on GitHub. If you
are a Greenbone customer you may alternatively or additionally forward your
issue to the Greenbone Support Portal.

Maintainer

This project is maintained by Greenbone AG.

Contributing

Your contributions are highly appreciated. Please create a pull
request on GitHub.
Remember to commit the contribution agreement as explained in RELICENSING folder with your first PR.
Bigger changes should be discussed with the development team via the issues section at GitHub first.
Since the project has an autolabel for releases (patch, minor and major), commit messages should follow the rules explained in conventional commit rules document.

License

This repository consists of two scanner implementation, one in programming language C and one in programming language Rust.

This module except for the Rust-implementation in directory rust/ is licensed under the GNU General Public License v2.0 only. Single files, however, are licensed either under the GNU General Public License v2.0 only or under GNU General Public License v2.0 or later, please see the license-details.md file for details.

The Rust-implementation in directory rust/ is licensed under the GNU General Public License v2.0 or later with OpenSSL exception. Single files, however, are additionally licensed under MIT.

Overview (`.docker/README.md`)

Docker Build Files

This directory contains the container build files and data used for OpenVAS scanner images.

Files

  • prod.Dockerfile builds all supported production-style image variants.
  • Makefile downloads and extracts the vendored source trees used by prod.Dockerfile.
  • vendor/ contains the extracted upstream source trees.
  • packages/ contains the runtime package lists selected by VERSION.

Supported Variants

The single prod.Dockerfile is parameterized and is used for:

  • stable
  • oldstable
  • testing

Default Build

The default build produces the stable image variant.

Prepare the vendored source trees first:

sh
make -C .docker

Then build:

sh
podman build -f .docker/prod.Dockerfile .

Important Build Arguments

`VERSION`

Selects the image variant behavior.

Examples:

  • latest for the stable build
  • oldstable for the oldstable build
  • testing-edge for the testing build

This value is used to derive:

  • the base image tag for gvm-libs unless explicitly overridden
  • the runtime package list from .docker/packages/${VERSION}.txt
  • whether Debian apt suite aliases are rewritten to VERSION_CODENAME

Examples:

sh
--build-arg VERSION=latest
--build-arg VERSION=oldstable
--build-arg VERSION=testing-edge

`GVM_LIBS`

Overrides the gvm-libs repository.

Default:

sh
ghcr.io/greenbone/gvm-libs

Example:

sh
--build-arg GVM_LIBS=ghcr.io/greenbone/gvm-libs

`BIN_VERSION`

Optional version string passed into the Rust build.

Example:

sh
--build-arg BIN_VERSION=23.0.0

`RUST_IMAGE`

Overrides the Rust builder image.

This is mainly needed for oldstable builds.

Example:

sh
--build-arg RUST_IMAGE=rust:bookworm

`OPENVAS_SMB_IMAGE`

Overrides the image used for the openvas-smb stage.

This is mainly needed for the testing build.

Example:

sh
--build-arg OPENVAS_SMB_IMAGE=greenbone/openvas-smb:testing-edge

Runtime Package Lists

Runtime packages are stored in separate files:

  • packages/latest.txt
  • packages/oldstable.txt
  • packages/testing-edge.txt

This keeps package differences out of the Dockerfile.

Build Examples

Stable

sh
make -C .docker
podman build \
  -f .docker/prod.Dockerfile \
  --build-arg VERSION=latest \
  .

Oldstable

sh
make -C .docker
podman build \
  -f .docker/prod.Dockerfile \
  --build-arg VERSION=oldstable \
  --build-arg RUST_IMAGE=rust:bookworm \
  .

Testing

sh
make -C .docker
podman build \
  -f .docker/prod.Dockerfile \
  --build-arg VERSION=testing-edge \
  --build-arg OPENVAS_SMB_IMAGE=greenbone/openvas-smb:testing-edge \
  .

Overview (`RELICENSE/README.md`)

openvas-scanner contribution agreement

We want to relicense our code to GPL-3.0-or-later or AGPL-3.0-or-later in the future. Although most of the new code is licensed under GPL-2.0-or-later we want to make sure that no problems occur when relicensing. Your contributions are licensed under MIT-0 and instantly relicensed to our currently used license. This means either GPL-2.0-or-later or GPL-2.0. Rust code is currently licensed with GPL-2.0-or-later per default. C code depends on the location and changes.

Please read and commit the /template/template.txt as [Name].md in this folder with your first PR. Having a valid git.user.name and git.user.email is sufficient.

Example usage:

text
# check with e.g. `git config --list` if you have a valid `user.name` and `user.email` set.
$ git config --list
    [email protected]
    user.name=jane Doe
    ....

# Commit the template
$ cd {path_to_openvas-scanner}/openvas-scanner/RELICENSE
$ cp ./template/template.txt JDoe.md
$ git add JDoe.md
$ git commit

Happy hacking!

Overview (`compose/README.md`)

OpenVAS Scanner Compose

This directory contains compose files and helper targets for running
openvasd locally with Docker or Podman.

Files

  • base.yaml: feed, Notus, GPG, Redis, openvas, and Volume services
  • openvasd.yaml: adds the openvasd service
  • tls.yaml: adds TLS
  • mtls.yaml: adds mutual TLS
  • local-registry.yaml: local registry services used by the compose test setup
  • tests/victim.yaml: extra services used by the compose test setup
  • tests/rust-tests.yaml: runs rust integration tests that require a compose setup
  • Makefile: helper targets for certificates, local startup and the rust API tests

Requirements

  • docker compose, docker-compose, or podman-compose
  • make
  • for mTLS examples: curl
  • for manual API helpers: curl, jq

Certificates

The TLS and mTLS setups use certificates from certs/ by default.

If you do not have local certificates yet, generate the development ones with:

bash
make

This creates:

  • certs/server.pem
  • certs/server.key
  • certs/clients/client1.pem
  • certs/clients/client1.key

Running The Stack

Start the HTTP openvasd setup:

bash
podman-compose -f base.yaml -f openvasd.yaml up

Start with TLS:

bash
podman-compose -f base.yaml -f openvasd.yaml -f tls.yaml up

Start with mTLS:

bash
podman-compose -f base.yaml -f openvasd.yaml -f mtls.yaml up

When mTLS is enabled, client requests must include the client key and certificate:

bash
curl -vk \
  --key certs/clients/client1.key \
  --cert certs/clients/client1.pem \
  https://localhost:3000/scans

Makefile Targets

The main helper targets are:

  • make test-environment-up: start the compose test environment
  • make test-environment-running: start the compose test environment and wait for services
  • make local-test-environment-up: build the local image and start the compose test environment
  • make local-test-environment-running: build the local image, start it, and wait for services
  • make test-environment-down: stop the compose test environment and remove volumes
  • make rust-test: run Rust tests that require the compose test environment

Tests Directory Layout

  • tests/Makefile: manual helper targets for creating, starting, stopping, querying, and removing scans via the API

Environment Variables

Variable Default Description
OPENVAS_IMAGE ghcr.io/greenbone/openvas-scanner:stable Image used by test-environment-up
OPENVASD_EXTERNAL_BIND_ADDRESS 127.0.0.1:3000 Host bind address
OPENVAS_LOG_LEVEL 64 Numeric log level for OpenVAS
OPENVAS_REDIS_MEMORY_LIMIT 0 Redis memory limit
OPENVAS_REDIS_MEMORY_RESERVATION 0 Redis memory reservation hint
OPENVAS_REDIS_RESTART_CONDITION on-failure Redis restart policy
OPENVASD_MEMORY_LIMIT 0 openvasd memory limit
OPENVASD_MEMORY_RESERVATION 0 openvasd memory reservation hint
OPENVASD_RESTART_CONDITION on-failure openvasd restart policy

Overview (`doc/README.md`)

OpenVAS Documentation (WORK IN PROGRESS)

The new documentation is still a WORK IN PROGRESS!!

The documentation of this project contains three parts:

  1. Doxygen
    It is used as a documentation of the internal c library. To build the doxygen documentation call make doxygen-full.

  2. Man
    In the man folder you can find man pages of the executables of the project. These are automatically installed when calling make install. Additionally it is possible to generate man pages of the built-in nasl functions. These can be generated with make man. Be aware that those are currently not automatically installed and pandoc is required in order to be able to generate those.

  3. Manual
    It is also possible to generate a general purpose manual of the openvas project. The manual can be generated with make manual and contains various information about the OpenVAS project including the NASL-documentation. Also for this pandoc is required.

Overview (`rust/README.md`)

Rust Scanner implementation

This is the rust scanner implementation with the goal to replace the current scanner stack
(openvas-scanner, ospd-openvas, notus-scanner), including the Open Scanner Protocol (OSP). The rust implementation of the new HTTP scanner API is called
openvasd. It provides an interface to manage scans for vulnerability testing. It currently utilizes the openvas-scanner to perform tasks.

This project also consist of a collection of tools called scannerctl. It contains variety of utilities for different tasks. For more information look into scannerctl.

Implementation of the NASL Attack Scripting Language

The goal is to have rust based implementation of NASL.

NASL is a domain-specific language (DSL) used by OpenVAS Scanner to write vulnerability tests and other security checks.

The decision to rewrite certain parts in rust was mainly to have an easier way to maintain it in the future the decision for rust is based on the interoperability between rust and c source code so that we can integrate our rust code in openvas and vice versa when it is required to do so.

The implementation is split into multiple parts that are reflected in the directory layout.

Requirements

  • rust toolchain
  • openssl
  • libclang
  • libnetsnmp
  • libpcap
  • openssl
  • pkg-config
  • zlib

Build

To build and create the executables

  • scannerctl
  • openvasd

You have to execute

text
make
cargo build --release

The make command builds required c libraries. For more information check Documentation

Contribution

If you are unsure how to start or want to discuss an improvement or feature feel free to create an issue.

Feel invited to create a draft PR and open a discussions about a new feature, improvements or even architectural changes if you want to discuss based on concrete examples.

If you want to help we are very happy about:

  • built in functions implementations
  • documentation improvements

Additionally we want to:

  • do improvements in the built in function handling as we want to be more modular
  • clean up the storage interface as it is very misleading currently because it enforced implementations of retrieve and dispatch.
  • extend scannerctl with a openvas-nasl like functionality so that we can test scripts
  • implement multithreading of interpreter
  • implement scheduling for a multi script run
  • create an http frontend based on OpenAPI definition

Structure of the code

The codebase is structured roughly as follows:

  • nasl: Contains the NASL syntax, interpreter and builtin functions.
  • nasl/syntax: Definition of the NASL syntax.
  • nasl/interpreter: The NASL language interpreter.
  • nasl/utils: Utilities to make working with the NASL interpreter and implementing new builtin functions easier.
  • nasl/builtin: The builtin NASL functions. This is divided into submodules depending on the functionality (i.e. string, ssh, http, ...).
  • storage: Implementation of the different methods to store scan results. This contains code that is relevant to all storage types, as well as submodules containing the code of the individual storage types.
  • scanner: Implementation of the openvasd scanner type.
  • feed: Functionality to perform feed verification and updates.
  • models: Defines types that are commonly used throughout the codebase.
  • ..

Integration with existing implementations is done in openvas and osp.

This crate provides two binaries: openvasd, which is the main executable and scannerctl, which is used for performing quick tests of NASL functionality and has many other utility functions.

Current status

The programs openvasd and scannerctl are usable, but might not support all features yet. The current openvasd implementation does not use and internal rust scanner yet, but still uses the c implementation of the openvas-scanner. Additionally depending on the configuration, an ospd-openvas instance is also needed.

Overview (`.github/workflows/README.md`)

GitHub Actions workflows

The workflows are organized by the event that starts them. Build, test, and
release implementations are kept in reusable workflows so that the entry
workflows contain only orchestration.

Entry workflows

`ci.yml` — continuous integration

Runs for open pull requests, pushes to main, and merge groups. It calls the
reusable unit-test, lint, and build workflows. Merge groups additionally run the
binary builds for amd64 and arm64 and stable, testing, and oldstable container
compatibility builds.

Merge gate is the single aggregate job intended for branch protection.

`container.yml` — container publishing

Runs on pushes to main, version tags, the weekly schedule, repository
dispatches, or manual dispatch. It initializes the version and calls
push-container.yml to build and publish the stable, testing, and oldstable
multi-architecture images.

Container publishing is deliberately separate from pull-request validation.

`release.yml` — release orchestration

Runs manually with an explicit major, minor, or patch choice. It also preserves
the existing release-label behavior for merged pull requests:

  • major_release
  • minor_release
  • patch_release

The workflow calculates the version, builds both architecture-qualified Rust
artifacts, and calls create-release.yml.

Other entry workflows

  • auto_label.yml: labels pull requests from conventional commits.
  • codeql.yml: analyzes the C code on pull requests, main, and weekly.
  • dependency-review.yml: reviews dependency changes on pull requests.
  • detect-hidden-unicode.yml: checks pull requests for hidden Unicode.
  • docs.yml: checks Markdown links when documentation changes.
  • integration-build.yml: runs the weekly/manual Bookworm integration build.
  • package-build-on-release.yml: triggers downstream packaging after a release.
  • sbom-upload.yml: uploads the SBOM on main or by manual dispatch.

Reusable workflows

  • init.yaml: calculates refs, versions, and container-tag properties.
  • tests.yml: runs C, Rust, and Compose-dependent Rust tests.
  • linting.yml: runs C/Rust formatting, Clippy, typos, and license checks.
  • build.yml: builds C and calls the AMD64 and ARM64 Rust binary builder.
  • rust-binaries.yaml: builds openvasd and scannerctl for one architecture.
  • container-compatibility.yml: build-only validation of the three container
    variants on AMD64.
  • push-container.yml: publishes the three multi-architecture container
    variants and performs registry follow-up work.
  • create-release.yml: creates, signs, and uploads a GitHub release.

Required check

Configure repository rules to require only Merge gate. Keep the CI workflow
and Merge gate job names stable because GitHub identifies required checks by
their displayed names.

Overview (`compose/tests/README.md`)

Manual Scan API Helpers

This directory contains helper targets for manually creating and controlling
scans against a running openvasd instance.

Purpose

Use tests/Makefile when you want to interact with the API manually during
development, for example to:

  • create a scan from a JSON definition
  • start or stop an existing scan
  • inspect scan status or results
  • remove a previously created scan

Requirements

  • running openvasd instance
  • make
  • curl
  • jq
  • client certificates in ../certs/clients/

Usage

Run these commands from compose/tests/.

Create a scan

bash
make create-<name>

This reads ../../rust/data/tests/scanner/scans/<name>.json, creates the scan through
the API, and stores the returned scan ID in known-scans/<name>.

Start a scan

bash
make start-<name>

Stop a scan

bash
make stop-<name>

Show status

bash
make status-<name>

Show results

bash
make results-<name>

Remove a scan

bash
make rm-<name>

This deletes the scan through the API and removes the local ID file.

Available Targets

Targets are generated from JSON files in ../../rust/data/tests/scanner/scans/.

For each <name>.json, the following targets are available:

  • create-<name>
  • start-<name>
  • stop-<name>
  • status-<name>
  • results-<name>
  • rm-<name>

Example

bash
make create-victim-full-and-fast
make start-victim-full-and-fast
make status-victim-full-and-fast
make results-victim-full-and-fast
make rm-victim-full-and-fast

Overview (`rust/examples/README.md`)

This contains a rudimentary feed for testing purposes.

This is not a real feed.

Overview (`rust/crates/nasl-c-lib/README.md`)

nasl-c-lib

Contains C functions, structures, and Rust wrappers used by NASL builtin functions.

This library uses the Rust cc crate to compile C code with the system C compiler.

Some parts of the C implementation require external static libraries. Those archives and headers are generated into build-cache/archives by the crate-local Makefile, using the build-archives stage from ../../../.docker/prod.Dockerfile.

The generated archive bundle matches the build setup described in doc/build.md, especially the bundle-style configuration using:

  • OPENVAS_ARCHIVES
  • LIBPCAP_LIBDIR

The build scripts emit the required linker search paths automatically from the resolved archive locations.

Preparing the build cache

From the repository root:

sh
make

Or from this crate directory:

sh
make

The Makefile will:

  • use docker if available
  • otherwise use podman if available
  • use distrobox-host-exec automatically when running inside distrobox

This generates the required static archives and headers in:

text
crates/nasl-c-lib/build-cache/archives

The resulting bundle layout is the one expected by the Rust build scripts from doc/build.md, including archives such as:

  • libpcap.a
  • libgssapi_krb5.a
  • libkrb5.a
  • libk5crypto.a
  • libcom_err.a
  • libkrb5support.a
  • headers in include/

If you want to build manually without the Makefile, or if you need the direct non-bundle environment-variable setup, see doc/build.md.

To remove the generated cache:

sh
make clean

Add new C functions

  1. Create a new .c and .h file in the c directory. Please use or create an appropriate sub-directory.
  2. Configure build.rs
    1. Add .file("c/your/code.c") to the cc builder.
    2. Add println!("cargo:rerun-if-changed=c/your/header.h");.
    3. Add additional required external libraries with println!("cargo:rustc-link-lib=static=your_lib");. The library must be built before with a libyourlib-sys crate. See libopenvas-krb5-sys for reference.
  3. Write a wrapper
    1. Create a Rust file in the src directory. Please use or create an appropriate sub-directory.
    2. Write the binding within extern "C".
    3. Write a public wrapper function that can be used by other libraries.

Additional notes

  • The println! macro is used to set flags for the Rust compiler.
  • The external C libraries are prepared through build scripts and the generated build cache.

Overview (`rust/crates/rpmdb-rs/README.md`)

rpmdb-rs

Rust implementation of rpmdb forked from yybit/rpmdb-rs, currently only supports reading package list

Available rpmdb format:

  • bdb
  • ndb
  • sqlite3

Example

text
let packages = rpmdb::read_packages("../../data/tests/rpmdb/Packages".parse()?)?;
for package in packages {
    println!("{} {:?}", package.name, package.provides);
}

Overview (`rust/data/notus/README.md`)

Data Directory

This directory primarily contains data, that is necessary to write unit and integration tests.

Overview (`rust/src/openvasd/README.md`)

OpenVAS Daemon

Is the implementation for scanner-api.

Currently it is utilizing ospd-openvas.

Requirements

text
> readelf -d ./openvasd-x86_64-unknown-linux-gnu | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [ld-linux-x86-64.so.2]

Configuration

Create a configuration file under either:

  • /etc/openvasd/openvasd.toml
  • $HOME/.config/openvasd/openvasd.toml

or provide the -c flag when starting openvasd.

An example can be found here

For customer-facing tuning guidance for [container_image_scanner.image], see Container Image Scanner Configuration.

Authentication

The API supports two kinds of authentication methods:

  • API Key
  • Certificates

The authentication modes are set within a configuration file or via the argument list, when starting the server.

The authentication is required for each request except for a HEAD request.

API Key

An API key is a token that the client provides when doing API requests and are used to authorize access.

If you want to enforce the requirement for clients to provide an x-api-key
header, make sure to set the key configuration option under [endpoints] to the
desired value. Clients connecting to the service will need to include this
header with the configured value for successful authentication.

The X-API-KEY must be in the header

curl --insecure --request GET https://localhost:3000/scans -H "X-API-KEY: mtls_is_preferred"

Certificates

Both methods TLS and Mutual TLS (mTLS) are supported for authentication, while the second is strongly recommended, since it guaranties that both network connection ends are who they say to be.

If you want to enable TLS for secure communication, ensure that the TLS
certificate files are in place and accessible.

Server Certificates: The server certificate and private key files should be
located at the paths specified in the tls.certs and tls.key configuration
options, respectively. Adjust the file paths in the configuration if necessary.

Client Certificates: If you want to restrict access to clients with specific
client certificates, ensure that the directory specified in the
tls.client_certs configuration option contains the required client certificate
files.

How does mTLS works?

It is similar to the known TLS, but there are some extra steps. In the following list of steps for stablishing a mTLS connection, the steps written in bold are the extra steps for mTLS:

  1. The client connects to the server
  2. The server presents its TLS certificate
  3. The client verifies the server certificate
  4. The client presents its TLS certificate
  5. The server verifies the client certificate
  6. The server gives access to the client
  7. Client and server exchange information through a encrypted TLS connection.

Certificate Authority for pki

Who implements mTLS is its own Certification Authority. This is a difference from standard TLS, where an external organization verifies and validates the TLS certificates.
For mTLS is necessary a TLS root certificate which allows an organization to be its owns certificate authority. The root CA signs intermediate certificates forming a chain of trust. The intermediate CA is created for security reasons. then, the root certificate is used as less as possible and in case the intermediate key is compromised, the root CA can revoke the intermediate key and create a new one.
Finally, the intermediate CA is used to sign client and server certificates.

In the examples folder for a PKI Mutual TLS you can find three scripts for creation of root and intermediate CA, client and server pairs (keys and certs).

Once you created the all key-certs pairs, you can use them for stablishing a mTLS secure connection between openvasd and the clients.

In the openvasd.toml configuration file, under the section [tls]:

  • set the variable certs with the path to the server certificate,
  • set the variable key with the path to the server key,
  • set the variable client_certs with the path to the intermediate CA certificate.

You should store in a secure place the root and intermediate key, which are not necessary anymore, but only for revoke/create intermediate CA pairs.

On the client side, you use the client key, the client cert and the same intermediate CA certificate you use in the server side. An example of usage is the following curl command:

curl --insecure --verbose --cert client.cert --key client.key --cacert CA/ca.cert --request GET https://localhost:3000/scans -H "X-API-KEY: mtls_is_preferred"

Now, since both server and client are signed by the same CA, certificates can be verified and the encrypted connection is authenticated.

mTLS with self-signed client certificates.

This method is similar to the explained above, but differs in that the clients and server certificates are self-signed, or signed by different CAs.
Then, the clients have to register a single certificate with the authorization server, and there is no shared CA certificate.
During authentication, the server checks if the client uses the same certificate for the TLS session as was configured or registered for that individual client. The server trusts the pinned certificate. The client's organization does not have to maintain any public key infrastructure and can simply use a self-signed certificate for authentication.

The scripts for generating the self-signed certificate can be found in self-signed folder.

Once you created the all key-certs pairs, you can use them for stablishing a mTLS secure connection between openvasd and the clients.

In the openvasd.toml configuration file, under the section [tls]:

  • set the variable certs with the path to the server certificate,
  • set the variable key with the path to the server key,
  • set the variable client_certs with the path to the folder with all registered client's self-signed certificates, previously shared via a secure method.

On the client side, you use the client key and the client certificate. An example of usage is the following curl command:

curl --insecure --verbose --cert client.cert --key client.key --request GET https://localhost:3000/scans -H "X-API-KEY: mtls_is_preferred"

As can be seen, no CA certificate is used, since instead the client certificate is used on the server side.

Mode

Openvasd currently supports two operation modes. The service mode supports all available endpoints, where the service_notus mode only supports the notus related endpoints.

Usage

text
/* Detailed source-code truncated for AI context efficiency. */

Feed signature check.

If the signature check is enabled, it is also required to set the the GNUPGHOME environment variable with the path to the keyring.

Options

Option Long Command Short Command Config Section Config Name Environment Variable Description Default Value
Config Path --config -c OPENVASD_CONFIG Path to toml config file
Feed Path --feed-path feed path FEED_PATH Path to the OpenVAS feed. If no lock file directory is configured, its parent directory must be writable. /var/lib/openvas/plugins
Feed lock file directory --lock-file-dir feed lock_file_dir LOCK_FILE_DIR Directory in which openvasd creates feed-update.lock; must be writable. Defaults to the parent directory of the feed path. /var/lib/openvas
Feed Signature Check --feed-signature-check -x feed signature_check Enable feed signature check. false
Feed Check Interval --feed-check-interval feed.check_interval secsnanos FEED_CHECK_INTERVAL Interval to check for feed updates in seconds. Using the config file, it can be set in seconds and nanoseconds 3600 (seconds)
Notus advisories path --advisories notus advisories_path NOTUS_ADVISORIES Path containing the Notus advisories directory /var/lib/notus/advisories/
Notus products path --products notus products_path NOTUS_PRODUCTS Path containing the Notus products /var/lib/notus/products/
Redis URL --redis-url storage.redis url REDIS_URL Redis url. Either unix:// or redis:// redis://localhost:6379
TLS Certificates --tls-certs tls certs TLS_CERTS Path to server TLS certs file. If none is given, TLS is disabled
TLS Key --tls-key tls key TLS_KEY Path to server TLS key
TLS Client Certificates --tls-client-certs tls client_certs TLS_CLIENT_CERTS Path to client TLS certs enables mTLS
Enable get scans --enable-get-scans endpoints enable_get_scans ENABLE_GET_SCANS Enables GET /scans endpoint false
API key --api-key endpoints key API_KEY API key that must be set as X-API-KEY header to gain access. If none is given, api-key authorization is disabled
Scanner Type --scanner-type scanner type SCANNER_TYPE Type of wrapper used to manage scans, currently only OSPD is available OSPD
Max queued scans --max-queued-scans scheduler max_queued_scans MAX_QUEUED_SCANS Maximum number of queued scans, omit for no limits
Max running scans --max-running-scans scheduler max_running_scans MAX_RUNNING_SCANS Maximum number of active running scans, omit for no limits
Min free memory --min-free-mem scheduler min_free_mem MIN_FREE_MEMORY Minimum memory that must be available in order to start a scan. If not set, there is no limit.
Scheduler check interval --check-interval scheduler.check_interval secsnanos SCHEDULER_CHECK_INTERVAL Iteration interval for the scheduler secs = 0nanos = 500000000
OSPD Socket --opsd-socket scanner.ospd socket OSPD_SOCKET Path to the unix socket of ospd-openvas /var/run/ospd/ospd.sock
Socket read timeout --read-timeout scanner.ospd.read_timeout secsnanos READ_TIMEOUT Max time openvasd waits for an ospd-openvas response before returning a 500 code (Internal server error). Using the config file, it can be set in seconds and nanoseconds Waits forever
Result Check Interval --result-check-interval scanner.ospd.result_check_interval secsnanos RESULT_CHECK_INTERVAL Interval to check for new results in seconds. Using the config file, it can be set in seconds and nanoseconds 1 (second)
Listening --listening -l listener address LISTENING IP address and port to listen to 127.0.0.1:3000
Storage type --storage-type storage type STORAGE_TYPE Information can either be stored in memory or on the filesystem inmemory
Storage path --storage-path storage location STORAGE_PATH Directory for the main and container image scanner SQLite databases; must be writable. in-memory does not use a directory. in-memory
Log Level --log-level -L log level OPENVASD_LOG Level of log messages to be shown. TRACE > DEBUG > INFO > WARN > ERROR INFO
Service mode --mode mode OPENVASD_MODE Sets the openvasd mode, can be either service or service_notus service
Help --help -h Print help

Migration from previous OSP commands

In this page you can find a guide for API usage of previous OSP commands

Overview (`rust/src/scannerctl/README.md`)

Table of Contents

scannerctl

Is CLI frontend to use rust scanner utilities.

Usage: scannerctl [OPTIONS] <COMMAND>

Options:

  • -v, --verbose: Prints more details while running
  • -h, --help: Print help
  • -V, --version: Print version

Build

Run cargo test to test and cargo build --release to build it.

Install

cargo install --path .

It requires the dependencies:

text
> readelf -d ./scannerctl-x86_64-unknown-linux-gnu  | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libpcap.so.0.8]
 0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [ld-linux-x86-64.so.2]

Commands

execute

Executes either a script or a scan.a

Usage: scannerctl execute [COMMAND]

script

Executes a nasl script using a in memory data base.

It executes either a script via a path or an OID. When an OID is provided it requires the -p option to be valid feed to find the script belonging to that OID, otherwise the -p is optional and when set does not need to have a sha256sums.

The optional --target, -t option allows to set a host target to run the script against to:

When -v is set it is printing the statements to be executed as well as the returned NaslValue.

As examples executing: scannerctl execute examples/hello.nasl returns:

text
Hello, world!

while executing scannerctl -v execute examples/hello.nasl returns:

text
> if (description == 1) {{ ... }}
=> Null
> display(Hello, world!)
Hello, world!
=> Null

Usage: scannerctl execute script [OPTIONS] [-t HOST] <script>

scan

Executes a given scan using a in memory data base.

A scan can either be provided by stdin in combination with the --input flag or via json file.

Usage: scannerctl execute scan [OPTIONS] --path <FILE> [json]

Arguments: [json]: The scan json as described in scanner-api

Options:

  • -p, --path <FILE>: Path to the feed.
  • --schedule: Prints just the schedule without executing the scan
  • -i, --input: Parses scan json from stdin.
  • -h, --help: Print help

Usage: scannerctl execute scan [OPTIONS] --path <FILE> [json]

syntax

text
Verifies syntax of NASL files in given dir or file.

Usage: scannerctl syntax [OPTIONS] <path>

Arguments:
  <path>

Options:
  -q, --quiet  Prints only error output and no progress.
  -h, --help   Print help

scan-config

Transforms a scan-config from gvmds data-objects to scan json of openvasd.

To set the target and credentials you can pipe a partial scan json into scannerctl scan-config by providing -i flag.

As an example we assume that the data-objects feed is in ~/src/greenbone/data-objects/content/22.04 while the vulnerability feed is in ~/src/greenbone/vulnerability-tests/nasl/common and we want to create a scan to verify localhost with a discovery and full and fast policy on the openvas default portlist.

For that we need to execute:

text
echo '{ "target": { "hosts": ["localhost"], "ports": [] }, "vts": [] }'| \
scannerctl scan-config -i -p ~/src/greenbone/vulnerability-tests/nasl/common \
  -l ~/src/greenbone/data-objects/content/22.04/port-lists/openvas-default-c7e03b6c-3bbe-11e1-a057-406186ea4fc5.xml \
  ~/src/greenbone/data-objects/content/22.04/scan-configs/discovery-8715c877-47a0-438d-98a3-27c7a6ab2196.xml \
  ~/src/greenbone/data-objects/content/22.04/scan-configs/full-and-fast-daba56c8-73ec-11df-a475-002264764cea.xml

Be aware that each call does a description run of the defined feed to gather the meta data, depending on your system and the size of the feed it requires may some time.

Usage

text
Transforms a scan-config xml to a scan json for openvasd.
When piping a scan json it is enriched with the scan-config xml and may the portlist otherwise it will print a scan json without target or credentials.

Usage: scannerctl scan-config [OPTIONS] <scan-config>

Arguments:
  <scan-config>

Options:
  -p, --path <FILE>      Path to the feed.
  -i, --input            Parses scan json from stdin.
  -l, --portlist <FILE>  Path to the port list xml
  -h, --help             Print help

notus

Does use notus products to compare packages against known vulnerabilities. It can be used to do a single notus scan by providing a list of packages and an operating system. A notus scan will then lookup the provided packages and compares it version to known vulnerabilities. The results will be printed on the command line.

Usage

text
does use notus products to compare packages against known vulnerabilities.

Usage: scannerctl notus [OPTIONS] --path <FILE> <os>...

Arguments:
  <os>...

Options:
  -p, --path <FILE>   Path to the product feed.
  -i, --input         comma separated pkg list from stdin.
  -l, --pkg <STRING>  Comma separated list of packages.
  -v, --verbose...    Prints more details while running
  -h, --help          Print help

feed

Handles feed related tasks.

Usage: scannerctl feed <COMMAND>

update

Runs nasl scripts in description mode and updates data into redis so that ospd-openvas can read the data.
Also, load the Notus advisories up into the redis cache. The path to the notus advisories must be provided.

When either path or redis is not set it will get the defaults by calling openvas -s.

Usage scannerctl feed update [OPTIONS]

Usage example, load both:
GPGHOME=/path/to/.gnupg scannerctl feed update --notus-path --signature-check

Options:

  • -v, --vts-only: Load only nvts into redis cache
  • -n, --notus-only: Load only Notus advisories into redis cache
  • --vts-path <FILE>: Path to the feed.
  • --notus-path <FILE>: Path to the notus advisories.
  • -x, --signature-check: Enable NASL signature check.
  • -r, --redis <VALUE>: Redis url. Must either start unix:// or redis://.

On feed update it will first read the sha256sums file within the feed directory and verify each file with the corresponding sha256sums. When the hash is correct it will execute each mentioned *.nasl script within that dir with description = 1.
Optionally, it is possible to perform a signature verification of the sha256sums file before uploading. To perform the signature check, also the environment variable GNUPGHOME must be set with the gnupg home directory, where the pubring.kbx file is stored.

Notus advisories and VTs can be uploaded independtently using the options --vts-only and --notus-only respectively. They can not be used together.

transform

Runs nasl scripts in description mode and returns it as a json array into stdout.

When path is not set it will get the defaults by calling openvas -s.

Usage scannerctl feed transform [OPTIONS]

Options:

  • -p, --path <FILE>: Path to the feed.

On feed transform it will create a list of nasl files within the feed directory, without verification. Each mentioned *.nasl script within that dir will be executed with description = 1.

It will produce a json array in stdout in the format described within json-storage

NVT

Describes meta information for a nasl script. Each nasl script must have a description block that may looks something like:

text
if (description)
{
  script_oid("0.0.0.0.0.0.0.0.0.1");
  script_version("2023-02-23T13:33:44+0000");
  script_tag(name:"last_modification", value:"2020-12-07 13:33:44 +0000 (Mon, 07 Dec 2020)");
  script_tag(name:"creation_date", value:"2009-05-12 22:04:51 +0200 (Tue, 12 May 2009)");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:N");
  script_name("Application Server Detection (HTTP)");
  script_category(ACT_GATHER_INFO);
  script_tag(name:"qod_type", value:"remote_banner");
  script_family("Product detection");
  script_copyright("Copyright (C) 2023 Greenbone AG");
  script_dependencies("find_service.nasl", "httpver.nasl", "global_settings.nasl");
  script_require_ports("Services/www", 6262);
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_tag(name:"summary", value:"HTTP AS detection");
  script_xref(name:"URL", value:"https://greenbone.net");
  exit(0);
}
...
exit(42);

Based on the requirement that each description block must have an exit(0); call in it the script can be safely run with description = 1. to update / create so called meta-data.

oid

The script id, following roughly the oid pattern. Each oid must be unique within a feed.

name

The name of the script. A freely choosable text.

filename

The relative filename of the script. It does not include the feed path and is relative to the feed directory.

tag

A struct that contain multiple information set via script_tag.

  • solution - a string.
  • solution_method - a string,
  • last_modification - unix timestamp as a number,
  • solution_type - either: Mitigation, NoneAvailable, VendorFix, WillNotFix, Workaround
  • creation_date - unix timestamp as a number,
  • severity_origin - a string,
  • qod_type - either: executable_version, executable_version_unreliable, exploit, general_note, package, registry, remote_active, remote_analysis, remote_app, remote_banner, remote_banner_unreliable, remote_probe, remote_vul
  • impact - a string,
  • insight - a string,
  • qod - a number,
  • severity_date - unix timestamp as a number,
  • summary - a string,
  • vuldetect - a string,
  • affected - a string,
  • deprecated - bool either true or false,
  • severity_vector - a string,
  • cvss_base_vector - a string

dependencies

A list of dependencies as a string representing a relative path a nasl file.

required_keys

A list of keys in the kb that a required for that nasl script to run.

mandatory_keys

A list of keys in the kb that a mandatory for that nasl script to run.

excluded_keys

A list of keys in the kb that prevent that nasl script to run.

required_ports

A list of required ports as string.

required_udp_ports

A list of required udp ports as string.

references

A list of references:

  • class - string, the class of a reference
  • id - the type of reference

preferences

A list of preferences.

  • id - string, the id of a preference,
  • class - either: checkbox, entry, file, password, radio, sshlogin
  • name - string, the name of the preference,
  • default - string, default value of the preference

category

The script category; can either be:

  • attack - will be run within the attack stage
  • denial - will be run within the denial stage
  • destructive_attack - will be run within the destructive_attack stage
  • end - will be run within the end stage
  • flood - will be run within the flood stage
  • gather_info - will be run within the gather_info stage
  • init - will be run within the init stage
  • kill_host - will be run within the kill_host stage
  • mixed_attack - will be run within the mixed_attack stage
  • scanner - will be run within the scanner stage
  • settings - will be run within the settings stage

family

The family a script belongs to. Is a freely choosable string.

Overview (`rust/examples/scannerctl/scan-configs/README.md`)

Scan-Configs

This directory contains scan configurations, similar to the ones provided by GVMD.

In the examples we asumme that a skeleton scan configuration is created prior to executing the commands.

As an example create a skeleton.json file with the following entry:

json
{
  "target": {
    "hosts": [
      "127.0.0.1"
    ],
    "ports": [
    ]
  },
  "vts": [
  ]
}

This is used by the examples to generate a scan targeting the localhost.

To transform a scan configuration to a scan JSON file, use the following command:

bash
cat skeleton.json | scannerctl scan-config -i -p PATH_TO_FEED -l PATH_TO_THE_PORTLIST PATH_OF_THE_CONFIGURATION > output.json

It is also possible to combine multiple configurations by including multiple configuration files in the command.

bash
cat skeleton.json | scannerctl scan-config \
    -l openvas-default-portlist.xml \
    -p /var/lib/openvas/plugins \
    discovery.xml adapted-full-and-fast.xml > dff.json

Adapted Full and Fast

bash
cat skeleton.json | scannerctl scan-config \
    -l openvas-default-portlist.xml \
    -p /var/lib/openvas/plugins \
    adapted-full-and-fast.xml > ff.json

To configuration "adapted-full-and-fast.xml" is an adapted version of the "Full and fast" scan configuration provided by GVMD.

It contains the families:

  • Port scanners
  • AIX Local Security Checks
  • Amazon Linux Local Security Checks
  • Brute force attacks
  • Buffer overflow
  • CISCO
  • CentOS Local Security Checks
  • Citrix Xenserver Local Security Checks
  • Compliance
  • Credentials
  • Databases
  • Debian Local Security Checks
  • Default Accounts
  • Denial of Service
  • F5 Local Security Checks
  • FTP
  • Fedora Local Security Checks
  • Finger abuses
  • Firewalls
  • FortiOS Local Security Checks
  • FreeBSD Local Security Checks
  • Gain a shell remotely
  • General
  • Gentoo Local Security Checks
  • Huawei
  • Huawei EulerOS Local Security Checks
  • HP-UX Local Security Checks
  • IT-Grundschutz
  • IT-Grundschutz-10
  • IT-Grundschutz-11
  • IT-Grundschutz-12
  • IT-Grundschutz-13
  • IT-Grundschutz-15
  • JunOS Local Security Checks
  • Mac OS X Local Security Checks
  • Mageia Linux Local Security Checks
  • Malware
  • Mandrake Local Security Checks
  • Netware
  • Nmap NSE
  • Nmap NSE net
  • Oracle Linux Local Security Checks
  • PCI-DSS
  • PCI-DSS 2.0
  • Palo Alto PAN-OS Local Security Checks
  • Peer-To-Peer File Sharing
  • Policy
  • Privilege escalation
  • Product detection
  • RPC
  • Red Hat Local Security Checks
  • Remote file access
  • SMTP problems
  • SNMP
  • SSL and TLS
  • Service detection
  • Settings
  • Slackware Local Security Checks
  • Solaris Local Security Checks
  • SuSE Local Security Checks
  • Ubuntu Local Security Checks
  • Useless services
  • VMware Local Security Checks
  • Web Servers
  • Web application abuses
  • Windows
  • Windows : Microsoft Bulletins

As well as the OIDs:

  • 1.3.6.1.4.1.25623.1.0.810003
  • 1.3.6.1.4.1.25623.1.0.810002

Discovery

bash
cat skeleton.json | scannerctl scan-config \
    -l openvas-default-portlist.xml \
    -p /var/lib/openvas/plugins \
    discovery.xml > discovery.json

To configuration "discovery.xml" is an adapted version of the "Discovery" scan configuration provided by GVMD.

It contains the families:

  • Product detection

As well as the OIDs:

  • 1.3.6.1.4.1.25623.1.0.803575
  • 1.3.6.1.4.1.25623.1.0.803574
  • 1.3.6.1.4.1.25623.1.0.803537
  • 1.3.6.1.4.1.25623.1.0.801805
  • 1.3.6.1.4.1.25623.1.0.803570
  • 1.3.6.1.4.1.25623.1.0.801803
  • 1.3.6.1.4.1.25623.1.0.803533
  • 1.3.6.1.4.1.25623.1.0.801801
  • 1.3.6.1.4.1.25623.1.0.801800
  • 1.3.6.1.4.1.25623.1.0.801685
  • 1.3.6.1.4.1.25623.1.0.801649
  • 1.3.6.1.4.1.25623.1.0.801299
  • 1.3.6.1.4.1.25623.1.0.801298
  • 1.3.6.1.4.1.25623.1.0.803528
  • 1.3.6.1.4.1.25623.1.0.801291
  • 1.3.6.1.4.1.25623.1.0.801604
  • 1.3.6.1.4.1.25623.1.0.801253
  • 1.3.6.1.4.1.25623.1.0.803569
  • 1.3.6.1.4.1.25623.1.0.803568
  • 1.3.6.1.4.1.25623.1.0.803567
  • 1.3.6.1.4.1.25623.1.0.803566
  • 1.3.6.1.4.1.25623.1.0.803529
  • 1.3.6.1.4.1.25623.1.0.803564
  • 1.3.6.1.4.1.25623.1.0.803563
  • 1.3.6.1.4.1.25623.1.0.803525
  • 1.3.6.1.4.1.25623.1.0.803524
  • 1.3.6.1.4.1.25623.1.0.803523
  • 1.3.6.1.4.1.25623.1.0.803520
  • 1.3.6.1.4.1.25623.1.0.801634
  • 1.3.6.1.4.1.25623.1.0.810010
  • 1.3.6.1.4.1.25623.1.0.801632
  • 1.3.6.1.4.1.25623.1.0.803551
  • 1.3.6.1.4.1.25623.1.0.11882
  • 1.3.6.1.4.1.25623.1.0.802726
  • 1.3.6.1.4.1.25623.1.0.102016
  • 1.3.6.1.4.1.25623.1.0.10400
  • 1.3.6.1.4.1.25623.1.0.103621
  • 1.3.6.1.4.1.25623.1.0.13751
  • 1.3.6.1.4.1.25623.1.0.19585
  • 1.3.6.1.4.1.25623.1.0.10946
  • 1.3.6.1.4.1.25623.1.0.11125
  • 1.3.6.1.4.1.25623.1.0.11427
  • 1.3.6.1.4.1.25623.1.0.11431
  • 1.3.6.1.4.1.25623.1.0.51662
  • 1.3.6.1.4.1.25623.1.0.103999
  • 1.3.6.1.4.1.25623.1.0.103996
  • 1.3.6.1.4.1.25623.1.0.50282
  • 1.3.6.1.4.1.25623.1.0.11040
  • 1.3.6.1.4.1.25623.1.0.103978
  • 1.3.6.1.4.1.25623.1.0.11033
  • 1.3.6.1.4.1.25623.1.0.90022
  • 1.3.6.1.4.1.25623.1.0.900239
  • 1.3.6.1.4.1.25623.1.0.103585
  • 1.3.6.1.4.1.25623.1.0.10919
  • 1.3.6.1.4.1.25623.1.0.10921
  • 1.3.6.1.4.1.25623.1.0.10758
  • 1.3.6.1.4.1.25623.1.0.10920
  • 1.3.6.1.4.1.25623.1.0.108477
  • 1.3.6.1.4.1.25623.1.0.10990
  • 1.3.6.1.4.1.25623.1.0.80064
  • 1.3.6.1.4.1.25623.1.0.80063
  • 1.3.6.1.4.1.25623.1.0.80062
  • 1.3.6.1.4.1.25623.1.0.14378
  • 1.3.6.1.4.1.25623.1.0.14377
  • 1.3.6.1.4.1.25623.1.0.100083
  • 1.3.6.1.4.1.25623.1.0.80059
  • 1.3.6.1.4.1.25623.1.0.11762
  • 1.3.6.1.4.1.25623.1.0.108204
  • 1.3.6.1.4.1.25623.1.0.108203
  • 1.3.6.1.4.1.25623.1.0.108199
  • 1.3.6.1.4.1.25623.1.0.108198
  • 1.3.6.1.4.1.25623.1.0.800984
  • 1.3.6.1.4.1.25623.1.0.80045
  • 1.3.6.1.4.1.25623.1.0.11913
  • 1.3.6.1.4.1.25623.1.0.11908
  • 1.3.6.1.4.1.25623.1.0.11907
  • 1.3.6.1.4.1.25623.1.0.11906
  • 1.3.6.1.4.1.25623.1.0.11822
  • 1.3.6.1.4.1.25623.1.0.20160
  • 1.3.6.1.4.1.25623.1.0.80100
  • 1.3.6.1.4.1.25623.1.0.901121
  • 1.3.6.1.4.1.25623.1.0.103190
  • 1.3.6.1.4.1.25623.1.0.20301
  • 1.3.6.1.4.1.25623.1.0.80005
  • 1.3.6.1.4.1.25623.1.0.80004
  • 1.3.6.1.4.1.25623.1.0.80003
  • 1.3.6.1.4.1.25623.1.0.103098
  • 1.3.6.1.4.1.25623.1.0.103326
  • 1.3.6.1.4.1.25623.1.0.103086
  • 1.3.6.1.4.1.25623.1.0.10761
  • 1.3.6.1.4.1.25623.1.0.15766
  • 1.3.6.1.4.1.25623.1.0.15765
  • 1.3.6.1.4.1.25623.1.0.17244
  • 1.3.6.1.4.1.25623.1.0.802244
  • 1.3.6.1.4.1.25623.1.0.103156
  • 1.3.6.1.4.1.25623.1.0.103070
  • 1.3.6.1.4.1.25623.1.0.100950
  • 1.3.6.1.4.1.25623.1.0.100074
  • 1.3.6.1.4.1.25623.1.0.100069
  • 1.3.6.1.4.1.25623.1.0.100062
  • 1.3.6.1.4.1.25623.1.0.10006
  • 1.3.6.1.4.1.25623.1.0.100034
  • 1.3.6.1.4.1.25623.1.0.14259
  • 1.3.6.1.4.1.25623.1.0.100315
  • 1.3.6.1.4.1.25623.1.0.104098
  • 1.3.6.1.4.1.25623.1.0.104021
  • 1.3.6.1.4.1.25623.1.0.104143
  • 1.3.6.1.4.1.25623.1.0.104124
  • 1.3.6.1.4.1.25623.1.0.104125
  • 1.3.6.1.4.1.25623.1.0.104001
  • 1.3.6.1.4.1.25623.1.0.104109
  • 1.3.6.1.4.1.25623.1.0.104104
  • 1.3.6.1.4.1.25623.1.0.104121
  • 1.3.6.1.4.1.25623.1.0.104120
  • 1.3.6.1.4.1.25623.1.0.104093
  • 1.3.6.1.4.1.25623.1.0.104076
  • 1.3.6.1.4.1.25623.1.0.104091
  • 1.3.6.1.4.1.25623.1.0.104075
  • 1.3.6.1.4.1.25623.1.0.104074
  • 1.3.6.1.4.1.25623.1.0.104057
  • 1.3.6.1.4.1.25623.1.0.104053
  • 1.3.6.1.4.1.25623.1.0.104018
  • 1.3.6.1.4.1.25623.1.0.104158
  • 1.3.6.1.4.1.25623.1.0.801698
  • 1.3.6.1.4.1.25623.1.0.803540
  • 1.3.6.1.4.1.25623.1.0.801696
  • 1.3.6.1.4.1.25623.1.0.801695
  • 1.3.6.1.4.1.25623.1.0.801693
  • 1.3.6.1.4.1.25623.1.0.801691
  • 1.3.6.1.4.1.25623.1.0.801619
  • 1.3.6.1.4.1.25623.1.0.801651
  • 1.3.6.1.4.1.25623.1.0.801650
  • 1.3.6.1.4.1.25623.1.0.801611
  • 1.3.6.1.4.1.25623.1.0.801261
  • 1.3.6.1.4.1.25623.1.0.801610
  • 1.3.6.1.4.1.25623.1.0.103147
  • 1.3.6.1.4.1.25623.1.0.103223
  • 1.3.6.1.4.1.25623.1.0.10666
  • 1.3.6.1.4.1.25623.1.0.15588
  • 1.3.6.1.4.1.25623.1.0.100795
  • 1.3.6.1.4.1.25623.1.0.103125
  • 1.3.6.1.4.1.25623.1.0.103124
  • 1.3.6.1.4.1.25623.1.0.103123
  • 1.3.6.1.4.1.25623.1.0.100780
  • 1.3.6.1.4.1.25623.1.0.9000001
  • 1.3.6.1.4.1.25623.1.0.14788
  • 1.3.6.1.4.1.25623.1.0.100770
  • 1.3.6.1.4.1.25623.1.0.103106
  • 1.3.6.1.4.1.25623.1.0.14773
  • 1.3.6.1.4.1.25623.1.0.10622
  • 1.3.6.1.4.1.25623.1.0.10462
  • 1.3.6.1.4.1.25623.1.0.100838
  • 1.3.6.1.4.1.25623.1.0.104157
  • 1.3.6.1.4.1.25623.1.0.104137
  • 1.3.6.1.4.1.25623.1.0.104135
  • 1.3.6.1.4.1.25623.1.0.104010
  • 1.3.6.1.4.1.25623.1.0.104088
  • 1.3.6.1.4.1.25623.1.0.104089
  • 1.3.6.1.4.1.25623.1.0.104130
  • 1.3.6.1.4.1.25623.1.0.104114
  • 1.3.6.1.4.1.25623.1.0.104069
  • 1.3.6.1.4.1.25623.1.0.104085
  • 1.3.6.1.4.1.25623.1.0.104111
  • 1.3.6.1.4.1.25623.1.0.104110
  • 1.3.6.1.4.1.25623.1.0.104068
  • 1.3.6.1.4.1.25623.1.0.104067
  • 1.3.6.1.4.1.25623.1.0.104066
  • 1.3.6.1.4.1.25623.1.0.104063
  • 1.3.6.1.4.1.25623.1.0.104048
  • 1.3.6.1.4.1.25623.1.0.104029
  • 1.3.6.1.4.1.25623.1.0.104167
  • 1.3.6.1.4.1.25623.1.0.104165
  • 1.3.6.1.4.1.25623.1.0.104026
  • 1.3.6.1.4.1.25623.1.0.104149
  • 1.3.6.1.4.1.25623.1.0.104163
  • 1.3.6.1.4.1.25623.1.0.104147
  • 1.3.6.1.4.1.25623.1.0.803519
  • 1.3.6.1.4.1.25623.1.0.801822
  • 1.3.6.1.4.1.25623.1.0.801821
  • 1.3.6.1.4.1.25623.1.0.803516
  • 1.3.6.1.4.1.25623.1.0.803550
  • 1.3.6.1.4.1.25623.1.0.803512
  • 1.3.6.1.4.1.25623.1.0.803510
  • 1.3.6.1.4.1.25623.1.0.801666
  • 1.3.6.1.4.1.25623.1.0.801237
  • 1.3.6.1.4.1.25623.1.0.801621
  • 1.3.6.1.4.1.25623.1.0.803544
  • 1.3.6.1.4.1.25623.1.0.803549
  • 1.3.6.1.4.1.25623.1.0.803547
  • 1.3.6.1.4.1.25623.1.0.803507
  • 1.3.6.1.4.1.25623.1.0.803508
  • 1.3.6.1.4.1.25623.1.0.803543
  • 1.3.6.1.4.1.25623.1.0.801811
  • 1.3.6.1.4.1.25623.1.0.100755
  • 1.3.6.1.4.1.25623.1.0.10379
  • 1.3.6.1.4.1.25623.1.0.11154
  • 1.3.6.1.4.1.25623.1.0.11153
  • 1.3.6.1.4.1.25623.1.0.14674
  • 1.3.6.1.4.1.25623.1.0.801234
  • 1.3.6.1.4.1.25623.1.0.100669
  • 1.3.6.1.4.1.25623.1.0.14664
  • 1.3.6.1.4.1.25623.1.0.100819
  • 1.3.6.1.4.1.25623.1.0.100651
  • 1.3.6.1.4.1.25623.1.0.11134
  • 1.3.6.1.4.1.25623.1.0.100489
  • 1.3.6.1.4.1.25623.1.0.102048
  • 1.3.6.1.4.1.25623.1.0.11128
  • 1.3.6.1.4.1.25623.1.0.10342
  • 1.3.6.1.4.1.25623.1.0.11121
  • 1.3.6.1.4.1.25623.1.0.11120
  • 1.3.6.1.4.1.25623.1.0.103997
  • 1.3.6.1.4.1.25623.1.0.100558
  • 1.3.6.1.4.1.25623.1.0.100479
  • 1.3.6.1.4.1.25623.1.0.11032
  • 1.3.6.1.4.1.25623.1.0.10175
  • 1.3.6.1.4.1.25623.1.0.10330
  • 1.3.6.1.4.1.25623.1.0.102017
  • 1.3.6.1.4.1.25623.1.0.10159
  • 1.3.6.1.4.1.25623.1.0.902447
  • 1.3.6.1.4.1.25623.1.0.66286
  • 1.3.6.1.4.1.25623.1.0.102001
  • 1.3.6.1.4.1.25623.1.0.102003
  • 1.3.6.1.4.1.25623.1.0.17975
  • 1.3.6.1.4.1.25623.1.0.102005
  • 1.3.6.1.4.1.25623.1.0.100288
  • 1.3.6.1.4.1.25623.1.0.100280
  • 1.3.6.1.4.1.25623.1.0.19608
  • 1.3.6.1.4.1.25623.1.0.100518
  • 1.3.6.1.4.1.25623.1.0.19289
  • 1.3.6.1.4.1.25623.1.0.100517
  • 1.3.6.1.4.1.25623.1.0.20834
  • 1.3.6.1.4.1.25623.1.0.100187
  • 1.3.6.1.4.1.25623.1.0.100259
  • 1.3.6.1.4.1.25623.1.0.100331
  • 1.3.6.1.4.1.25623.1.0.100254
  • 1.3.6.1.4.1.25623.1.0.100329
  • 1.3.6.1.4.1.25623.1.0.18393
  • 1.3.6.1.4.1.25623.1.0.100082
  • 1.3.6.1.4.1.25623.1.0.11987
  • 1.3.6.1.4.1.25623.1.0.11986
  • 1.3.6.1.4.1.25623.1.0.101013
  • 1.3.6.1.4.1.25623.1.0.100300
  • 1.3.6.1.4.1.25623.1.0.18534
  • 1.3.6.1.4.1.25623.1.0.18533
  • 1.3.6.1.4.1.25623.1.0.18532
  • 1.3.6.1.4.1.25623.1.0.80095
  • 1.3.6.1.4.1.25623.1.0.80092
  • 1.3.6.1.4.1.25623.1.0.11963
  • 1.3.6.1.4.1.25623.1.0.17583
  • 1.3.6.1.4.1.25623.1.0.103652
  • 1.3.6.1.4.1.25623.1.0.20377
  • 1.3.6.1.4.1.25623.1.0.11945
  • 1.3.6.1.4.1.25623.1.0.80079
  • 1.3.6.1.4.1.25623.1.0.11865
  • 1.3.6.1.4.1.25623.1.0.11929
  • 1.3.6.1.4.1.25623.1.0.10401
  • 1.3.6.1.4.1.25623.1.0.902425
  • 1.3.6.1.4.1.25623.1.0.902798
  • 1.3.6.1.4.1.25623.1.0.900012
  • 1.3.6.1.4.1.25623.1.0.10394
  • 1.3.6.1.4.1.25623.1.0.12231
  • 1.3.6.1.4.1.25623.1.0.10942
  • 1.3.6.1.4.1.25623.1.0.108478
  • 1.3.6.1.4.1.25623.1.0.108102
  • 1.3.6.1.4.1.25623.1.0.108479
  • 1.3.6.1.4.1.25623.1.0.10386
  • 1.3.6.1.4.1.25623.1.0.19689
  • 1.3.6.1.4.1.25623.1.0.10661
  • 1.3.6.1.4.1.25623.1.0.11239
  • 1.3.6.1.4.1.25623.1.0.11111
  • 1.3.6.1.4.1.25623.1.0.900602
  • 1.3.6.1.4.1.25623.1.0.103416
  • 1.3.6.1.4.1.25623.1.0.10265
  • 1.3.6.1.4.1.25623.1.0.14644
  • 1.3.6.1.4.1.25623.1.0.91984
  • 1.3.6.1.4.1.25623.1.0.902816
  • 1.3.6.1.4.1.25623.1.0.900234
  • 1.3.6.1.4.1.25623.1.0.80066
  • 1.3.6.1.4.1.25623.1.0.18528
  • 1.3.6.1.4.1.25623.1.0.18373
  • 1.3.6.1.4.1.25623.1.0.18356
  • 1.3.6.1.4.1.25623.1.0.17585
  • 1.3.6.1.4.1.25623.1.0.15901
  • 1.3.6.1.4.1.25623.1.0.15615
  • 1.3.6.1.4.1.25623.1.0.15614
  • 1.3.6.1.4.1.25623.1.0.11414
  • 1.3.6.1.4.1.25623.1.0.11156
  • 1.3.6.1.4.1.25623.1.0.11140
  • 1.3.6.1.4.1.25623.1.0.11011
  • 1.3.6.1.4.1.25623.1.0.10794
  • 1.3.6.1.4.1.25623.1.0.10793
  • 1.3.6.1.4.1.25623.1.0.10762
  • 1.3.6.1.4.1.25623.1.0.10746
  • 1.3.6.1.4.1.25623.1.0.10742
  • 1.3.6.1.4.1.25623.1.0.10674
  • 1.3.6.1.4.1.25623.1.0.10441
  • 1.3.6.1.4.1.25623.1.0.103441
  • 1.3.6.1.4.1.25623.1.0.103141
  • 1.3.6.1.4.1.25623.1.0.103140
  • 1.3.6.1.4.1.25623.1.0.103118
  • 1.3.6.1.4.1.25623.1.0.10281
  • 1.3.6.1.4.1.25623.1.0.10263
  • 1.3.6.1.4.1.25623.1.0.10185
  • 1.3.6.1.4.1.25623.1.0.10150
  • 1.3.6.1.4.1.25623.1.0.10107

Doc Manual Index (`doc/manual/index.md`)

Introduction

GENERAL

This documentation is meant to get the new standard for the OpenVAS documentation. It will contain general information about different parts of the project, as well as a technical description of the language NASL with its grammar and library functions. In the current state this documentation is far from complete and will fill up by time.

SUMMARY

OpenVAS is a project containing several parts and programs. In general there are two main parts: the OpenVAS Scanner and NASL. The OpenVAS Scanner is more like an engine consisting of a scan management part, which manages different hosts and plugins. Plugins are scripts, interpreted by the NASL interpreter. There is also a standalone program, which allows to run NASL scripts directly without having a running scan.

To run a scan additional programs are needed. Currently the best way is to use the Greenbone Vulnerability Manager, Greenbone Security Assistant/Greenbone Security Assistant HTTP server and OSPD-OpenVAS

SEE ALSO

openvas, NASL

Doc Manual Nasl Index (`doc/manual/nasl/index.md`)

NASL Attack Scripting Language

GENERAL

The NASL Attack Scripting Language (NASL) is a language which is part of the OpenVAS Project and interpreted by the NASL interpreter. It is a simple language with focus on detecting vulnerabilities on network devices. Therefore it provides many built-in functions to attack hosts to discover vulnerabilities. A NASL script can be either run directly with the NASL interpreter openvas-nasl or within a scan with openvas.

Doc Manual Openvas Index (`doc/manual/openvas/index.md`)

OpenVAS Scanner

Overview

The OpenVAS Scanner is a scanner engine, which allows the user to scan networks.

Doc Manual Nasl Built In Functions Index (`doc/manual/nasl/built-in-functions/index.md`)

Built-in Functions

GENERAL

The NASL language contains a collection of built-in functions to provide many tools to detect vulnerabilities of a network device.

Doc Manual Nasl Predefined Constants Index (`doc/manual/nasl/predefined-constants/index.md`)

Predefined Constants

These constants are actually variables, i.e., their value can be modified in a script.

  • Boolean constants
    • FALSE = 0
    • TRUE = 1
  • Plug-in categories
    • ACT_INIT: the plug-in just sets a few KB items (kinds of global variables for all plug-ins).
    • ACT_SCANNER: the plug-in is a port scanner or something like it (e.g., ping).
    • ACT_SETTINGS: just like ACT_INIT, but run after the scanners, once it is sure that the host is alive (for performance).
    • ACT_GATHER_INFO: the plug-in identifies services, gathers data, parses banners, etc.
    • ACT_ATTACK: the plug-in launches a soft attack, e.g. a web directory traversal.
    • ACT_MIXED_ATTACK: the plug-in launches an attack that might have dangerous side effects (crashing the service most of the time).
    • ACT_DESTRUCTIVE_ATTACK: the plug-in tries to destroy data or launch some dangerous attack (e.g., testing a buffer overflow is likely to crash a vulnerable service).
    • ACT_DENIAL: the plugin tries to crash a service.
    • ACT_KILL_HOST: the plug-in tries to crash the target host or disable it (e.g., saturate the CPU, kill some vital service, ...).
    • ACT_FLOOD: the plug-in tries to crash the target host or disable it by flooding it with incorrect packets or requests. It may saturate the network or kill some routing, switching or filtering device on the way.
    • ACT_END: The plug-in runs at the very end of the scan
  • Network constants
    • Encapsulation types
      • ENCAPS_AUTO = 0, Request auto detection.
      • ENCAPS_IP = 1, this is the “transport” value for a pure TCP socket.
      • ENCAPS_SSLv23 = 2, this is the “transport” value for a SSL connection in compatibility mode. Note that the find_service plugin will never declare a port with this "encapsulation", but you may use it in a script.
      • ENCAPS_SSLv2 = 3, The old SSL version which only supports server side certificates. By the way, there is only one plugin that really tries to destroy data. This is http_methods.nasl
      • ENCAPS_SSLv3 = 4, The new SSL version: it supports server and client side certificates, more ciphers, and fixes a few security holes.
      • ENCAPS_TLSv1 = 5, TLSv1 is defined RFC 2246. Some people call it “SSL v3.1”.
      • ENCAPS_TLSv11 = 6
      • ENCAPS_TLSv12 = 7
      • ENCAPS_TLSv13 = 8
      • ENCAPS_TLScustom = 9, SSL/TLS using custom priorities.
      • ENCAPS_MAX = 10
    • Sockets options
      • MSG_OOB, a socket option used to send “out of band data”.
    • Raw sockets
      • IPPROTO_ICMP as defined in the system C include files.
      • IPPROTO_ICMPV6 (from netinet/ip.h)
      • IPPROTO_IGMP
      • IPPROTO_IP
      • IPPROTO_TCP
      • IPPROTO_UDP
      • IP_RF = 0x8000 (reserved fragment flag)
      • IP_DF = 0x4000 (dont fragment flag)
      • IP_MF = 0x2000 (more fragments flag)
      • IP_OFFMASK = 0x1fff (mask for fragmenting bits)
      • pcap_timeout = 5
      • TH_ACK = 0x10. This TCP flag indicates that the packet contains a valid acknowledgment.
      • TH_FIN = 0x01. This TCP flag indicates that the packet negotiates the end of the session.
      • TH_PUSH = 0x08.
      • TH_RST = 0x04. This TCP flag indicates that the connection was refused or “reset by peer”.
      • TH_SYN = 0x02. This belong to the initial handshake (connection opening).
      • TH_URG = 0x20. This TCP flag indicates that the packet contains urgent data
  • Miscellaneous constants
    • NULL is the undefined value
  • openvas-scanner glue
    • description is set to 1 when openvas-scanner parses the script the first time (to get its name, description, summary, etc.), then to 0 when it is run.
    • COMMAND_LINE is set to 0 when the script is run by openvas-scanner or to 1 when it is run by the NASL standalone interpreter.
  • NASL constants
    • ERR_NOERR = 0
    • ERR_ETIMEDOUT = 1
    • ERR_ECONNRESET = 2
    • ERR_EUNREACH = 3
    • ERR_EUNKNOWN = 99

Doc Manual Openvas Redis Index (`doc/manual/openvas/redis/index.md`)

Redis

GENERAL

Redis is a in-memory data base with a simple key-value data structure. It belongs to the family of NoSQL databases and therefore is not relational. It is not suitable for complex data structures, but benefits from its speed.

USAGE IN OPENVAS

The main use of Redis in OpenVAS is the communication. It is used to set information in order for OpenVAS to start a scan. This information are e.g. the host to scan, credentials for further access and configurations for the scanner. Additionally it is used for the scan internally to send information between forked processes, as each running NASL script is a forked process. The last usage is the reporting of information, errors and results.

SEE ALSO

redis-cli(1)

Doc Manual Nasl Built In Functions Built In Plugins Index (`doc/manual/nasl/built-in-functions/built-in-plugins/index.md`)

Built-in plugins

GENERAL

Here you can find complex built-in functions for NASL

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Cert Functions Index (`doc/manual/nasl/built-in-functions/cert-functions/index.md`)

Cert Functions

GENERAL

Implementation of an API for X.509 certificates.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Cryptographic Index (`doc/manual/nasl/built-in-functions/cryptographic/index.md`)

Cryptographic functions

GENERAL

These section contains all NASL function, which are related to cryptographic.

TABLE OF CONTENT

  • aes128_cbc_encrypt - encrypts given data with AES 128 CBC mode.
  • aes128_ccm_decrypt_auth - decrypts given data including a authentication token with AES 128 CCM mode.
  • aes128_ccm_decrypt - decrypts given encrypted data with AES 128 CCM mode.
  • aes128_ccm_encrypt_auth - encrypts given data including a authentication token with AES 128 CCM mode.
  • aes128_ccm_encrypt - encrypts given data with AES 128 CCM mode.
  • aes128_ctr_encrypt - encrypts given data with AES 128 CTR mode.
  • aes128_gcm_decrypt_auth - decrypts given data including a authentication token with AES 128 GCM mode.
  • aes128_gcm_decrypt - decrypts given encrypted data with AES 128 GCM mode.
  • aes128_gcm_encrypt_auth - encrypts given data including a authentication token with AES 128 GCM mode.
  • aes128_gcm_encrypt - encrypts given data with AES 128 GCM mode.
  • aes256_cbc_encrypt - encrypts given data with AES 256 CBC mode.
  • aes256_ccm_decrypt_auth - decrypts given data including a authentication token with AES 256 CCM mode.
  • aes256_ccm_decrypt - decrypts given encrypted data with AES 256 CCM mode.
  • aes256_ccm_encrypt_auth - encrypts given data including a authentication token with AES 256 CCM mode.
  • aes256_ccm_encrypt - encrypts given data with AES 256 CCM mode.
  • aes256_ctr_encrypt - encrypts given data with AES 256 CTR mode.
  • aes256_gcm_decrypt_auth - decrypts given data including a authentication token with AES 256 GCM mode.
  • aes256_gcm_decrypt - decrypts given encrypted data with AES 256 GCM mode.
  • aes256_gcm_encrypt_auth - encrypts given data including a authentication token with AES 256 GCM mode.
  • aes256_gcm_encrypt - encrypts given data with AES 256 GCM mode.
  • aes_mac_cbc - takes two named arguments key, data
  • aes_mac_gcm - takes two named arguments key, data
  • bf_cbc_decrypt - decrypts given data with blowfish CBC mode.
  • bf_cbc_encrypt - encrypts given data with blowfish CBC mode.
  • bn_cmp - takes two named arguments key1, key2. Returns 0 when they're equal, -1 when key1 > key2, +1 when key2 > key1
  • bn_random - takes one named arguments need to returns a message passing interface with the given amount of bits.
  • close_stream_cipher - closes a stream cipher.
  • des_ede_cbc_encrypt - encrypts given data with DES EDE CBC mode.
  • DES - takes a unnamed paramaeter and return DES hash.
  • dh_compute_key - computes the shared secret with the given shared parameter p and g, the servers public key and the clients private and public key.
  • dh_generate_key - takes three named arguments p, g and priv to generate the public key.
  • dsa_do_sign - computes DSA signature.
  • dsa_do_verify - verifies that the DSA signature matches the hash based on the public DSA key. Returns 1 if the signature is valid otherwise 0.
  • get_signature - takes four named arguments key, buf, buflen, seq_number
  • get_smb2_signature - takes two named arguments key, buf
  • HMAC_MD2 - takes named paramaeter data and key to return HMAC MD2 string.
  • HMAC_MD5 - takes named paramaeter data and key to return HMAC MD5 string.
  • HMAC_RIPEMD160 - takes named paramaeter data and key to return HMAC RIPEMD160 string.
  • HMAC_SHA1 - takes named paramaeter data and key to return HMAC SHA1 string.
  • HMAC_SHA256 - takes named paramaeter data and key to return HMAC SHA256 string.
  • HMAC_SHA384 - takes named paramaeter data and key to return HMAC SHA384 string.
  • HMAC_SHA512 - takes named paramaeter data and key to return HMAC SHA512 string.
  • insert_hexzeros - appends a empty byte to each character in a string
  • key_exchange - takes three named arguments cryptkey, session_key, nt_hash
  • lm_owf_gen - takes a unnamed parameter and returns LanMan one way hash.
  • MD2 - takes a unnamed paramaeter and return MD2 hash.
  • MD4 - takes a unnamed paramaeter and return MD4 hash.
  • MD5 - takes a unnamed paramaeter and return MD5 hash.
  • ntlm2_response - takes three named arguments cryptkey, password, nt_hash
  • ntlm_response - takes four named arguments cryptkey, password, nt_hash, neg_flags
  • NTLMv1_HASH - takes two named arguments cryptkey, pass_hash
  • NTLMv2_HASH - takes two named arguments cryptkey, pass_hash
  • ntlmv2_response - takes six named arguments cryptkey, user, domain, ntlmv2_hash, address_list, address_list_len to generate a ntlmv2 response.
  • nt_owf_gen - takes a unnamed paramaeter and returns NT one way hash.
  • ntv2_owf_gen - takes fiven named arguments owf, login, domain, length, insert_hexzeros to generate the NTLMv2 of a users's password.
  • open_rc4_cipher - opens an rc4 encryption handler for data stream encryptions.
  • pem_to_dsa - reads the private key in pem format to return the x parameter of the DSA key.
  • pem_to_rsa - reads the private key in pem format to return the d parameter of the RSA key.
  • prf_sha256 - takes four named arguments secret, seed, label, outlen
  • prf_sha384 - takes four named arguments secret, seed, label, outlen
  • rc4_encrypt - encrypts given data with rc4.
  • RIPEMD160 - takes a unnamed paramaeter and return RIPEMD160 hash
  • rsa_private_decrypt - decrypts provided data with the public RSA key given by e, n and d. Returns the decrypted data.
  • rsa_public_decrypt - decrypts provided data with the public RSA key given by e and d. Returns the decrypted data.
  • rsa_public_encrypt - encrypts provided data with the public RSA key given by e and n. Returns the encrypted data.
  • rsa_sign - signs data with the given private RSA key.
  • SHA1 - takes a unnamed paramaeter and return SHA1 hash
  • SHA256 - takes a unnamed paramaeter and return SHA256 hash
  • SHA512 - takes a unnamed paramaeter and return SHA512 hash
  • smb3kdf - is a key derivation function for SMB3
  • smb_cmac_aes_signature - takes two named arguments key, buf
  • smb_gmac_aes_signature - takes two named arguments key, buf, iv
  • tls1_prf - takes four named arguments secret, seed, label, outlen

Doc Manual Nasl Built In Functions Description Functions Index (`doc/manual/nasl/built-in-functions/description-functions/index.md`)

Description Functions

GENERAL

All those functions but script_get_preference are only used in the "description part" of the plugin, i.e. the block that is run when the description variable is 1. They have no effect when the plugin is run with the standalone NASL interpreter.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Glue Functions Index (`doc/manual/nasl/built-in-functions/glue-functions/index.md`)

Glue functions

GENERAL

This part contains functions that are dependent on openVAS.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Host Functions Index (`doc/manual/nasl/built-in-functions/host-functions/index.md`)

HostFunctions

GENERAL

Host functions are used to get, resolve, compare and add hosts to the vhosts list

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Http Functions Index (`doc/manual/nasl/built-in-functions/http-functions/index.md`)

HTTP Functions

GENERAL

These functions are mainly used for formatting HTTP request, and for opening and closing http sockets.

TABLE OF CONTENT

  • cgibin - Get the cgi-bin path elements.
  • http_close_socket - closes a socket.
  • http_delete - formats an HTTP DELETE request for the server on the port.
  • http_get - formats an HTTP DELETE request for the server on the port.
  • http_head - formats an HTTP HEAD request for the server on the port.
  • http_open_socket - opens a socket.
  • http_post - formats an HTTP POST request for the server on the port.
  • http_put - formats an HTTP PUT request for the server on the port.

Doc Manual Nasl Built In Functions Http2 Functions Index (`doc/manual/nasl/built-in-functions/http2-functions/index.md`)

HTTP2 Functions

GENERAL

These functions are mainly used for performing HTTP2 request.

TABLE OF CONTENT

  • http2_handle - Creates a handle for http requests.
  • http2_close_handle - Close a handle for http requests previously initialized.
  • http2_get_response_code - Get the http response code after performing a HTTP request.
  • http2_set_custom_header - Set a custom header element in the header.
  • http2_delete - performs an HTTP2 DELETE request for the server on the port.
  • http2_get - performs an HTTP2 DELETE request for the server on the port.
  • http2_head - performs an HTTP2 HEAD request for the server on the port.
  • http2_post - performs an HTTP2 POST request for the server on the port.
  • http2_put - performs an HTTP2 PUT request for the server on the port.

Doc Manual Nasl Built In Functions Isotime Functions Index (`doc/manual/nasl/built-in-functions/isotime-functions/index.md`)

ISO time functions

GENERAL

The ISO time is standardized form for representing time formats from the year 0 to 9999. This family of functions are able to generate and alter given times in such formats, as well as get information about the current time.

In most 32 bit systems a signed 32 bit integer value is used to represent the system time. Unfortunately this only enables the usage of time between 1. January 1970 00:00:00 to 19. January 2038 03:14:07. However for VTs we sometimes need to calculate dates in the future beyond that. For example some certificates are (for whatever reason) valid for 30 years. To solve this problem in a platform independent way, we provide the time as a string and provide functions to work with them.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Knowledge Base Get Host Kb Index (`doc/manual/nasl/built-in-functions/knowledge-base/get_host_kb_index.md`)

get_host_kb_index(3nasl)

NAME

get_host_kb_index - Get the KB index of the host running the current script

SYNOPSIS

int get_host_kb_index(name: string, value: any);

get_host_kb_index takes no arguments

DESCRIPTION

This function will return the index number of the currently used Redis Database. This index belongs to the host, which is currently scanned.

RETURN VALUE

KB index, int or None, when redis index cannot be determined

SEE ALSO

get_kb_item(3nasl), get_kb_list(3nasl), replace_kb_item(3nasl), set_kb_item(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Knowledge Base Index (`doc/manual/nasl/built-in-functions/knowledge-base/index.md`)

Knowledge-Base Functions

GENERAL

Knowledge-Base Functions are primarily used for inter-plugin communication.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Krb5 Index (`doc/manual/nasl/built-in-functions/krb5/index.md`)

Krb5 functions

General

Functions related to krb5 (Kerberos).

Table of contents

Doc Manual Nasl Built In Functions Misc Index (`doc/manual/nasl/built-in-functions/misc/index.md`)

MISC functions

GENERAL

Here you can find general purpose functions.

TABLE OF CONTENT

  • dec2str - converts given num as str
  • defined_func - check if a given function is defined
  • dump_ctxt - debug function to print the keys available within the called context
  • exit - ends the script with the given result code
  • get_byte_order - get byte order of host system
  • gettimeofday - get the number of seconds and microseconds since 1970-01-01
  • gunzip - decompress given data.
  • gzip - compress given data with gzip
  • isnull - check if a given value is NULL
  • keys - returns an array with the keys of a dict
  • localtime - returns an dict(mday, mon, min, wday, sec, yday, isdst, year, hour) based on optional given time in seconds and optional flag if utc or not.
  • make_array - takes any even number of unnamed arguments and returns an dictionary made from them
  • make_list - takes any number of unnamed arguments and returns an array made from them.
  • max_index - returns the length of an array.
  • mktime - takes seven named arguments sec, min, hour, mday, mon, year, isdst and returns the Unix time.
  • rand - returns a pseudo random number.
  • sleep - takes an integer and sleeps the amount of seconds
  • sort - sorts the value of a dict/array. WARNING: drops the keys of a dict and returns an array.
  • typeof - returns the type of given unnamed argument.
  • unixtime - returns the unix time (number of seconds since 1970-01-01).
  • usleep - takes an integer and sleeps the amount of microseconds

Doc Manual Nasl Built In Functions Misc Max Index (`doc/manual/nasl/built-in-functions/misc/max_index.md`)

max_index(3nasl)

NAME

max_index - returns the length of an array.

SYNOPSIS

int max_index(arr|dict);

max_index takes an array or dict and returns it length.

DESCRIPTION

Takes any number of unnamed arguments and returns an array made from them.

It can also be used to flatten arrays.

RETURN VALUE

Returns an indexed array made out of the arguments. The index starts at 0.

Error

Returns NULL when given argument is neither a dict nor an array.

EXAMPLES

cpp
arr = [0, 2, 3];
len = max_index(arr);

Doc Manual Nasl Built In Functions Network Functions Index (`doc/manual/nasl/built-in-functions/network-functions/index.md`)

Network Functions

General

In case of error, all those functions returns a value that can be interpreted as FALSE (most of the time NULL).

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Raw Ip Functions Index (`doc/manual/nasl/built-in-functions/raw-ip-functions/index.md`)

Raw IP Functions

GENERAL

All those functions work on blocks of data which are implemented as “pure strings". This means that you could change them with the string manipulation functions, but this is probably not very easy.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Regular Expressions Index (`doc/manual/nasl/built-in-functions/regular-expressions/index.md`)

Regular Expression Functions

GENERAL

A regular expression is a sequence of characters that specifies a search pattern in text. Usually such patterns are used by string-searching algorithms for "find" or "find and replace" operations on strings, or for input validation.

Functions in this family will work with such regular expressions to find or replace specific patterns within a given string.

All the regex functions work the same way. If you want to match from the beginning / end of your string (or your line, in the case of egrep), you’ll have to use ^ or $. You should read your (POSIX) system manual for details on regular expressions.

All NASL internal regex related functions like ereg(), eregmatch(), egrep(), ereg_replace(), =~ and !~ are currently supporting the standard POSIX Extended Regular Expressions (ERE) syntax only (full overview). Examples:

  • \s = Match a whitespace character (except newline)
  • [[:digit:]] = Match a digit character
  • \w = Match a "word" character (alphanumeric plus _)

It does NOT support Perl Compatible Regular Expressions (PCRE) like \d.

TABLE OF CONTENT

  • egrep - looks for a pattern in a string line by line and concatenates all lines the string was found
  • eregmatch - search for an pattern within a string
  • ereg - matches a given string against a regular expression
  • ereg_replace - searches and replaces all the occurrences of a pattern inside a string

Doc Manual Nasl Built In Functions Report Functions Index (`doc/manual/nasl/built-in-functions/report-functions/index.md`)

Report Functions

GENERAL

Those functions are used for reporting (send data back to daemon).

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Smb Functions Index (`doc/manual/nasl/built-in-functions/smb-functions/index.md`)

SMB Functions

GENERAL

Provides SMB API as built-in functions to NASL via calling corresponding functions of a appropriate library. The focus is on effective files rights which can't be retrieved via WMI.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Snmp Functions Index (`doc/manual/nasl/built-in-functions/snmp-functions/index.md`)

SNMP Functions

GENERAL

Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Devices that typically support SNMP include cable modems, routers, switches, servers, workstations, printers, and more. It is mostly used for network administrator to get information about available network devices and to be able to configure them remotely.

SNMP functions are used to get available SNMP devices in the network.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Ssh Functions Index (`doc/manual/nasl/built-in-functions/ssh-functions/index.md`)

SSH Functions

GENERAL

Used for SSH connections and interactions

TABLE OF CONTENT

Doc Manual Nasl Built In Functions String Functions Index (`doc/manual/nasl/built-in-functions/string-functions/index.md`)

String functions

GENERAL

Functions in this family are used to create and manipulate NASL strings.

TABLE OF CONTENT

  • chomp - removes trailing whitespaces from a string
  • crap - fill a string of desired length with given pattern
  • display - display any number of NASL values
  • hex - converts an integer into a hexadecimal number
  • hexstr - converts a string into a hexadecimal representation
  • insstr - insert a string into another string, replacing the substring given with indices
  • int - converts a given argument into an integer
  • match - matches a string against a simple shell-like pattern
  • ord - get the ASCII code of the first character of a given string
  • raw_string - transforms any input into a string
  • split - split a string into parts
  • strcat - concatenate given values
  • stridx - lookup the position of a substring within a string
  • string - concatenate given values
  • strlen - get the length of a string
  • str_replace - replace a substring within a string
  • strstr - finds the first occurrence of a sub-string within a string
  • substr - get a slice out of a string
  • tolower - converts a string to lower case
  • toupper - converts a string to upper case

Doc Manual Nasl Built In Functions Tls Index (`doc/manual/nasl/built-in-functions/tls/index.md`)

TLS functions

GENERAL

These functions are related to the handling of the sockets within a NASL script - for example the implementation of the NASL built-ins open_sock_tcp, send, recv, recv_line, and close.

TABLE OF CONTENT

Doc Manual Nasl Built In Functions Unsafe Index (`doc/manual/nasl/built-in-functions/unsafe/index.md`)

"unsafe" Functions

GENERAL

"unsafe" functions are working with the scanner host file system. It is possible to open, read and write files as well as run commands.

TABLE OF CONTENT

  • file_close - close a file descriptor
  • file_open - opens a file descriptor
  • file_read - read from a file
  • file_seek - set offset for file operations
  • file_stat - get size of a file
  • file_write - writes data to a file
  • find_in_path - searches a command in $PATH and returns TRUE if found, or FALSE if not. It takes one string argument (the command name)
  • fread - read a whole file on the openvas-scanner host
  • fwrite - write a file on the openvas-scanner host
  • get_tmp_dir - get a path to temporary directory
  • pread - runs a command on the host system
  • unlink - removes a file on the openvas scanner host

Doc Manual Nasl Built In Functions Wmi Functions Index (`doc/manual/nasl/built-in-functions/wmi-functions/index.md`)

WMI Functions

GENERAL

Provides WMI (Windows Management Instrumentation) functionalities via calling functions of a appropriate library.
The API offers three groups of functions:

  1. WMI_FUNCTIONS: run all-purpose queries
  2. WMI_RSOP_FUNCTIONS (RSoP = Resultant Set of Policy): run RSoP queries
  3. WMI_REGISTRY_FUNCTIONS: read and write values from/to the registry

These functions are only available when
openvas-smb is
installed.

TABLE OF CONTENT

Doc CMakeLists (`doc/CMakeLists.txt`)

SPDX-FileCopyrightText: 2023 Greenbone AG

SPDX-License-Identifier: GPL-2.0-or-later

build

include (FindDoxygen)

if (NOT DOXYGEN_EXECUTABLE)
message (STATUS "WARNING: Doxygen is required to build the HTML docs.")
else (NOT DOXYGEN_EXECUTABLE)
configure_file (Doxyfile.in Doxyfile @ONLY)
configure_file (Doxyfile_full.in Doxyfile_full @ONLY)
configure_file (Doxyfile_xml.in Doxyfile_xml @ONLY)

add_custom_target (doxygen COMMENT "Building documentation..."
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile ${CMAKE_CURRENT_BINARY_DIR}/.built-html)

add_custom_command (OUTPUT .built-html
COMMAND sh
ARGS -c "${DOXYGEN_EXECUTABLE} ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile && touch ${CMAKE_CURRENT_BINARY_DIR}/.built-html;"
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile)

add_custom_target (doxygen-full COMMENT "Building documentation..."
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_full ${CMAKE_CURRENT_BINARY_DIR}/.built-html_full)

add_custom_command (OUTPUT .built-html_full
COMMAND sh
ARGS -c "${DOXYGEN_EXECUTABLE} ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_full && touch ${CMAKE_CURRENT_BINARY_DIR}/.built-html_full;"
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_full)

add_custom_target (doxygen-xml COMMENT "Building documentation (XML)..."
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_xml ${CMAKE_CURRENT_BINARY_DIR}/.built-xml)

add_custom_command (OUTPUT .built-xml
COMMAND sh
ARGS -c "${DOXYGEN_EXECUTABLE} ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_xml && touch ${CMAKE_CURRENT_BINARY_DIR}/.built-xml;"
DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile_xml)
endif (NOT DOXYGEN_EXECUTABLE)

find_program(PANDOC pandoc)

if (NOT PANDOC)
message(STATUS "WARNING: pandoc is required to build the HTML user manual.")
else (NOT PANDOC)
configure_file(man.sh man.sh COPYONLY)
configure_file(man-touchup.lua man-touchup.lua COPYONLY)
configure_file(verify-links.lua verify-links.lua COPYONLY)
configure_file(html.sh html.sh COPYONLY)
configure_file(images/scanner_run_loop.svg images/scanner_run_loop.svg COPYONLY)
file(COPY manual DESTINATION .)
file(COPY templates DESTINATION .)

add_custom_target(manual COMMAND ${CMAKE_CURRENT_BINARY_DIR}/html.sh)
add_custom_target(man COMMAND ${CMAKE_CURRENT_BINARY_DIR}/man.sh)
endif (NOT PANDOC)

Doc Full Installation Guide (`doc/full_installation_guide.md`)

Full Openvas Installation Guide

This guide just links to the relevant parts of the official community documentation for building the scanner stack from source.

Some comments on different parts of the documentation

  1. prerequisites: You can decide how you want to install the stack. If you want to run it via a dedicated user and install via source/build/install folders you can follow this section of the guide. If not adjust accordingly.
  2. Installation source: For development just use git. Do not use the version variables as used in the guide.
  3. Install gvm-libs. Installing gvmd, pq-gvm, gsa, gsad is not needed if you only want to install the scanner stack.
  4. Install openvas-smb
  5. Install openvas-scanner
  6. Install ospd-openvas only if you want to install the complete gvm stack (with gvmd, pq-gvm, gsa, gsad)
  7. Install openvasd
  8. Install greenbone-feed-sync
  9. Performing a system setup: from this section only the following is needed for the scanner stack: Redis, some parts of permissions section (depending on setup), feed validation, sudo for scanning, systemd files for openvasd if you want to use systemd
  10. Perfroming feed sync

Now you can use the https://greenbone.github.io/scanner-api/ for running scans.

Doc Misc Undocumented Preferences (`doc/misc/undocumented-preferences.md`)

Why the following scanner preferences are undocumented

Some scanner preferences are found in the scanner code but are not documented in the man page. This is because such preferences are for internal usage or just preferences to be set via the client and there is no intention to be set via the configuration file. The following are the preferences and what they are used for and the reason they are not documented in the man page.

  • auth_port_ssh: This setting is scanner wide. Not to be set in the config file since it has priority. Internally used. It will be set by the client, else it is checked in the kb, else defaults to 22 (SSH default port).
  • config_file: Location of the config file. It can only be set via the command line.
  • TARGET: Is the host list to be attacked. Internally used and set by the client.
  • exclude_hosts: excluded host from the TARGET list. Internally used and set by the client.
  • hosts_ordering: intended to be used by the client. If Boreas is active, this option is ignored, since the host order changes in the mean the host are detected as alive
  • mqtt_enabled: internally used for selection of MQTT implementation of Notus (LSC)
  • http_lsc_enabled: internally used for selection of HTTP endpoint is used for Notus (LSC)
  • ov_maindbid: internally used.
  • plugin_set: List of plugin OIDs to be run against the target. This is set by the client and used to initialize the plugin scheduler.
  • reverse_lookup_only: Only scan IP addresses that can be resolved into a DNS name. To be set by the client.
  • reverse_lookup_unify: If multiple IP addresses resolve to the same DNS name the DNS name will only get scanned once. To be set by the client
  • source_iface: Deprecated. Currently ignored.
  • sys_ifaces_allow: Deprecated. Currently ignored.
  • sys_ifaces_deny: Deprecated. Currently ignored.
  • ifaces_allow: Deprecated and internally ignored
  • ifaces_deny: Deprecated and internally ignored

Rust Doc Build (`rust/doc/build.md`)

Building the Rust Binaries

This document explains how to build the Rust binaries with the static archives required by the build scripts.

Required Build Tools

The Rust build itself still needs the normal build-time packages.

Environment Variables

The Rust build scripts support two styles of configuration.

Bundle-style configuration

This is the setup used in .docker/prod.Dockerfile.

Variables:

  • OPENVAS_ARCHIVES
  • LIBPCAP_LIBDIR

Meaning:

  • OPENVAS_ARCHIVES points to a flat directory containing the required static archives and an include/ subdirectory.
  • LIBPCAP_LIBDIR points to the directory containing libpcap.a.

The build scripts emit the required native linker search paths automatically from the resolved archive locations.

Expected bundle layout:

text
archives/
├── libpcap.a
├── libgssapi_krb5.a
├── libkrb5.a
├── libk5crypto.a
├── libcom_err.a
├── libkrb5support.a
└── include/
    ├── pcap.h
    ├── krb5.h
    ├── com_err.h
    ├── profile.h
    ├── gssapi/
    └── krb5/

Direct configuration without a bundle directory

Instead of OPENVAS_ARCHIVES, the build scripts also accept dedicated variables for the custom static dependency.

Variables:

  • OPENVAS_KRB5_ARCHIVES
  • OPENVAS_KRB5_INCLUDE_DIR
  • LIBPCAP_LIBDIR

Meaning:

  • OPENVAS_KRB5_ARCHIVES is a path list containing:
    • libgssapi_krb5.a
    • libkrb5.a
    • libk5crypto.a
    • libcom_err.a
    • libkrb5support.a
  • OPENVAS_KRB5_INCLUDE_DIR points to the directory containing:
    • krb5.h
    • gssapi/gssapi.h
    • gssapi/gssapi_krb5.h
  • LIBPCAP_LIBDIR points to the directory containing libpcap.a.

The build scripts emit the required native linker search paths automatically from the resolved archive locations.

Note:

  • OPENVAS_KRB5_ARCHIVES is a path list.
  • Use your platform's normal path separator.
  • On Linux, that means :.

Example 0: Use the default archive bundle directory

This is the default local workflow and the one used by CI.

From the repository root:

sh
cd rust
make
cargo build --release

Or explicitly through the crate-local Makefile:

sh
cd rust
make -C crates/nasl-c-lib
cargo build --release

What make does:

  • builds the build-archives stage from .docker/prod.Dockerfile
  • copies /archives from the container image to crates/nasl-c-lib/build-cache/archives
  • uses docker if available
  • otherwise uses podman
  • uses distrobox-host-exec automatically when running inside distrobox

No extra environment variables are required for this setup. The build scripts in crates/nasl-c-lib automatically look for the default bundle directory at:

text
crates/nasl-c-lib/build-cache/archives

Use this approach unless you specifically want to manage archive locations yourself.

Example 1: Use an explicit archive bundle directory

This example shows the same bundle-based setup as example 0, but with OPENVAS_ARCHIVES and LIBPCAP_LIBDIR set explicitly.

To keep the example self-contained, the archive bundle is populated from the container build stage.

sh
mkdir -p rust/crates/nasl-c-lib/build-cache/archives

podman build \
  --target build-archives \
  -f .docker/prod.Dockerfile \
  -t openvas-build-archives \
  .

container_id=$(podman create openvas-build-archives)
podman cp "$container_id":/archives/. rust/crates/nasl-c-lib/build-cache/archives/
podman rm "$container_id"

Then build the Rust binaries:

sh
cd rust
export OPENVAS_ARCHIVES="$PWD/crates/nasl-c-lib/build-cache/archives"
export LIBPCAP_LIBDIR="$PWD/crates/nasl-c-lib/build-cache/archives"
cargo build --release

Example 2: Build Without a Bundle Directory

If you do not want to use OPENVAS_ARCHIVES, set the archive and include variables directly.

This example assumes:

  • libpcap.a is in $HOME/openvas-static/libpcap
  • krb5 archives are in $HOME/openvas-static/krb5/lib
  • krb5 headers are in $HOME/openvas-static/krb5/include

Example:

sh
cd rust

export OPENVAS_KRB5_ARCHIVES="$HOME/openvas-static/krb5/lib/libgssapi_krb5.a:$HOME/openvas-static/krb5/lib/libkrb5.a:$HOME/openvas-static/krb5/lib/libk5crypto.a:$HOME/openvas-static/krb5/lib/libcom_err.a:$HOME/openvas-static/krb5/lib/libkrb5support.a"
export OPENVAS_KRB5_INCLUDE_DIR="$HOME/openvas-static/krb5/include"

export LIBPCAP_LIBDIR="$HOME/openvas-static/libpcap"

cargo build --release

In this setup:

  • OPENVAS_ARCHIVES is not used
  • the krb5 build script gets explicit archive and include paths
  • libpcap is found through LIBPCAP_LIBDIR
  • the build scripts emit all required linker search paths from the resolved archive locations

Summary

For most users, use example 0:

  • run make in rust/
  • let the default archive bundle be generated in crates/nasl-c-lib/build-cache/archives
  • run cargo build --release

Use example 1 if you want to point the build explicitly at a bundle directory, and use example 2 only if you already manage the required static archives and headers yourself.

Rust Doc Container Image Scanner Configuration (`rust/doc/container-image-scanner-configuration.md`)

Container Image Scanner Configuration

This document explains how to tune the [container_image_scanner.image] section in openvasd.toml for customer environments.

These settings control where image data is temporarily unpacked, how many images may be scanned in parallel, and how retry behavior works when a registry request fails temporarily.

Configuration Options

Example:

toml
[container_image_scanner.image]
extract_to = "/var/lib/openvasd/cis"
scanning_retries = 5
max_scanning = 10
batch_size = 2
retry_timeout = "1s"

`extract_to`

Path where openvasd temporarily extracts image content during a scan.

Example:

toml
extract_to = "/var/lib/openvasd/cis"

How it works:

  • openvasd creates scan-specific directories below this path automatically.
  • Extracted image data is temporary working data, not long-term storage.
  • Cleanup is attempted automatically after scanning. If cleanup fails, files may remain on disk and can be removed during maintenance.

Customer guidance:

  • Use a dedicated local directory.
  • Prefer fast local SSD or NVMe storage.
  • Ensure the service account can create and delete directories below this path.
  • Size the filesystem for concurrent scans, especially when max_scanning is increased.
  • Avoid slow network storage unless you have verified that the performance is sufficient.

`scanning_retries`

Number of retry attempts after a retryable image download failure.

Example:

toml
scanning_retries = 5

How it works:

  • Retries are only used for retryable registry-related failures.
  • Typical retryable cases are temporary registry errors, temporary authentication failures, or transient blob download problems.
  • Non-retryable problems, such as invalid image references, are not fixed by increasing this value.

Customer guidance:

  • Use 3 to 5 in stable environments.
  • Use 8 to 10 only if temporary registry or network problems are common.
  • Higher values increase the time before a final failure is reported.

`max_scanning`

Maximum number of images that may be scanned concurrently.

Example:

toml
max_scanning = 10

How it works:

  • This is the main throughput control for image scanning.
  • Higher values can improve throughput if the system has enough network bandwidth, CPU, memory, and fast local storage.
  • Higher values also increase temporary disk usage below extract_to.
  • A value of 0 means unlimited concurrency.

Customer guidance:

  • Start with a conservative value and increase gradually.
  • Monitor CPU, memory, disk I/O, temporary storage usage, and registry response times while tuning.
  • Avoid 0 in production because it can create uncontrolled load.

`batch_size`

Number of images that may be picked up in one scheduler cycle.

Example:

toml
batch_size = 2

How it works:

  • This limits how many pending images are moved into active scanning in one cycle.
  • It also controls how often the scheduler checks for more work.
  • batch_size = 2 means the scheduler checks every 2 seconds.
  • Smaller values make scheduling more responsive.
  • Larger values admit work in larger bursts.
  • A value of 0 means unlimited batch size. In that case the scheduler still checks every 1 second.

Customer guidance:

  • Keep this value small in most environments.
  • 2 is a good default for many production systems.
  • Avoid 0 in production unless you have validated the behavior under peak load.

`retry_timeout`

Pause between retry attempts.

Example:

toml
retry_timeout = "1s"

How it works:

  • This defines how long openvasd waits before the next retry attempt.
  • Short values retry faster but can add pressure to an unstable or rate-limited registry.
  • Longer values reduce retry pressure but increase the time to complete or fail a scan.

Customer guidance:

  • Start with 1s to 5s.
  • Increase the value if your registry is overloaded or rate-limited.

How `max_scanning` and `batch_size` Work Together

max_scanning controls total concurrency. batch_size controls how many new images may start in each scheduler cycle and also defines the scheduler interval in seconds.

Practical example:

  • max_scanning = 10
  • batch_size = 2

This means:

  • openvasd checks every 2 seconds whether more images can be scanned.
  • Up to 2 additional images may start in each cycle.
  • The total number of actively scanned images never exceeds 10.

This combination gives predictable ramp-up behavior and avoids sudden bursts of activity.

The implementation contains these starting points for environments with a median image size of about 100 MB:

  • 1000mb/s: max_scanning = 10, batch_size = 2
  • 2500mb/s: max_scanning = 25, batch_size = 2
  • 5000mb/s: max_scanning = 50, batch_size = 2
  • 10000mb/s: max_scanning = 100, batch_size = 2

Use these values as a starting point, not as a guarantee.

Reduce these values if:

  • your images are significantly larger than 100 MB
  • the scanner host uses slow local storage
  • the scanner host has limited CPU or memory
  • your registry enforces strict rate limits
  • the scanner host shares resources with other critical workloads

Increase these values carefully only if:

  • image sizes are smaller than average
  • local storage is fast and has enough free space
  • the registry is able to handle the higher request volume
  • monitoring shows low resource utilization during scans

Example Profiles

Conservative Profile

Use this profile for small environments, limited storage performance, or initial rollout.

toml
[container_image_scanner.image]
extract_to = "/var/lib/openvasd/cis"
scanning_retries = 3
max_scanning = 5
batch_size = 2
retry_timeout = "2s"

Balanced Production Profile

Use this profile as a starting point for typical production environments.

toml
[container_image_scanner.image]
extract_to = "/var/lib/openvasd/cis"
scanning_retries = 5
max_scanning = 10
batch_size = 2
retry_timeout = "1s"

High-Throughput Profile

Use this only after validating system capacity and registry behavior.

toml
[container_image_scanner.image]
extract_to = "/var/lib/openvasd/cis"
scanning_retries = 5
max_scanning = 25
batch_size = 2
retry_timeout = "1s"

Operational Recommendations

  • Set extract_to explicitly instead of relying on a default path.
  • Keep temporary extraction data on fast local storage.
  • Monitor free disk space under the extraction filesystem.
  • Increase max_scanning gradually and measure the effect.
  • Tune retry_timeout and scanning_retries together.
  • Avoid max_scanning = 0 and batch_size = 0 in customer production environments.

Edge Cases

  • max_scanning = 0 means unlimited concurrent image scans.
  • batch_size = 0 means unlimited images may be admitted in one scheduler cycle.
  • When batch_size = 0, the scheduler still checks for work every 1 second.
  • Retries only apply to retryable registry-related failures, not to every possible scan failure.

Rust Doc Forking (`rust/doc/forking.md`)

Forking behavior.

A peculiar property of the NASL programming language is the forking.
From a user point of view, forking happens whenever certain builtin
functions are called. An example of such a function is get_kb_item.
This seemingly innocent function retrieves an item from the knowledge base, given a key.
As an example, consider the following NASL code:

nasl
set_kb_item(name: "foo", value: "bar1");
set_kb_item(name: "foo", value: "bar2");
display(get_kb_item("foo"));

Since the key "foo" has more than a single entry in the knowledge base, the call to
get_kb_item will implicitly perform forking. Effectively, after the call to get_kb_item, the interpreter will behave as if we had run two
identical scripts that only differ in the value that was returned by get_kb_item("foo"). From that point on, every statement will be executed
twice twice.
The above script would therefore print:

text
bar1
bar2

Multiple forks can take place at the same time. For example, this code

nasl
set_kb_item(name: "port", value: 1);
set_kb_item(name: "port", value: 2);
set_kb_item(name: "host", value: "a");
set_kb_item(name: "host", value: "b");
display(get_kb_item("host") + get_kb_item("port"));

will result in

text
a:1
a:2
b:1
b:2

being displayed.

Guarantees

Due to its implicit nature, forking leaves quite a few decisions open to the concrete implementation. In the following we will briefly discuss some of these decisions along with the way that they are currently implemented in the openvasd implementation of NASL. However, none of these should be relied upon:

Statement execution

When the interpreter forks into multiple sub-interpreters, the execution order is (statement1, interpreter1), (statement1, interpreter2), (statement1, interpreter3), ... (statement2, interpreter1), (statement2, interpreter2), (statement2, interpreter3), ....

Order of multiple forks.

If multiple forks are created:

nasl
get_kb_item("a");
get_kb_item("b");

the order in which they are created will be (a1, b1), (a1, b2), (a1, b3), ... (a2, b1), (a2, b2), (a2, b3), ....

Different branches

If different forks run into different branches within the statement in which they were created, the interpreter will return an error, resulting in stopped execution of the script. For example the script

nasl
set_kb_item(name: "test1", value: 1);
set_kb_item(name: "test1", value: 2);
set_kb_item(name: "test2", value: 3);
set_kb_item(name: "test2", value: 4);
set_kb_item(name: "test3", value: 5);
set_kb_item(name: "test3", value: 6);
if (get_kb_item("test1") == 1) {
    get_kb_item("test2");
}
else {
    get_kb_item("test3");
}

will result in an interpreter error. This is done in order to prevent ambiguous code that could result in very unexpected behavior from working.
In order to avoid situations like this, avoid relying on such conditional structures.

Forks never die

Forks always remain alive until the end of a script. Once a script forks, each fork will run until it exits. There is no concept to fork only for a specified subsection of the code. Such behavior can be achieved by a futuristic language feature called "loops".

Builtin functions that fork

As of writing, the only builtin functions that cause forks to happen are:

  1. get_host_name
  2. get_kb_item
  3. open_sock_tcp

Context, storage and memory in forks

In the current implementation, forks all share the same context. There is no concept to have separate contexts or storages for different forks.

Rust Doc Openvasd Osp Cmd Equivalence (`rust/doc/openvasd-osp-cmd-equivalence.md`)

Migration Guide for API usage of previous OSP commands

This document shows the migration of OSP commands (implemented by ospd-openvas) to the new scanner API (implemented by openvasd). It only provides the XML for the command and its corresponding JSON counterpart, as well as the endpoint of the HTTP API. For further information of the commands either see OSP or Scanner API.

Help command

there is a help command which includes all supported OSP commands and details. There is no equivalent command for Scanner API. Just refer to the Scanner API

xml
<help/>

Get memory usage command

This command shows RSS, VMS and shared current memory usage. It is a debugging purpose command. There is no equivalent command for Scanner API.

xml
<get_memory_usage unit='mb'/>

Start a scan

With OSP

To start a scan with OSP commands, it was just necessary one XML command which included the scan ID as parameter and the scan configuration

gvm-cli --protocol OSP socket --sockpath /tmp/openvas.sock --xml

start scan OSP command

xml
<start_scan scan_id='97079ee9-8917-49da-aa4f-4ef95f757ac1'>
  <targets>
    <target>
      <hosts>192.168.10.128</hosts>
      <ports>T:22,9390</ports>
      <alive_test>2</alive_test>
      <credentials>
      </credentials>
      <exclude_hosts/>
    </target>
  </targets>
  <vt_selection>
    <vt_single id='1.3.6.1.4.1.25623.1.0.14259'/>
    <vt_single id='1.3.6.1.4.1.25623.1.0.10330'/>
    <vt_single id='1.3.6.1.4.1.25623.1.0.108198'/>
  </vt_selection>
  <scanner_params>
    <test_empty_vhost>0</test_empty_vhost>
    <expand_vhosts>0</expand_vhosts>
    <unscanned_closed>0</unscanned_closed>
  </scanner_params>
</start_scan>

With Scanner API

while with Scanner API it is necessary to do it in two steps. First create the scan task in the server with

cmd
Method: POST
Endpoint: /scans
Json body:
json
{
  "target": {
    "hosts": [
      "192.168.0.1-10"
    ],
    "excluded_hosts": [
      "192.168.0.5"
    ],
    "ports": [
      {
        "protocol": "tcp",
        "range": [
          {
            "start": 22,
            "end": 22
          }
        ]
      }
    ],
    "alive_test_methods": [
      "icmp"
    ],
    "credentials": [
      {
        "service": "ssh",
        "port": 22,
        "up": {
          "username": "user",
          "password": "pass"
        }
      }
    ]
  },
  "vts": [
    {
        "oid": "1.3.6.1.4.1.25623.1.0.90022"
    }
  ]
}

where "simple_scan_ssh_only.json" is the scan config. This HTTP request will get a response from the server which includes a scan_id. Later, every operation done on this task, must be done using the received scan_id. So for starting the stored scan you use the following POST method in the URL, passing the action as json object.

cmd
Method: POST
Endpoint: /scans/{scan_id}
Parameter scan_id: : is de Scan ID
Json body:
json
{"action": "start"}

Stop a scan

As explained in the subsection above, you know the scan ID for OSP, because it is necessary for starting a new scan, while the scan ID is created by Openvasd when using Scanner API. Then the scan_id is necessary for both protocols.

With OSP

xml
<stop_scan scan_id='97079ee9-8917-49da-aa4f-4ef95f757ac1'/>

With Scanner API

cmd
Method: POST
Endpoint: /scans/{scan_id}
Parameter scan_id: : is de Scan ID
Json body:
json
{"action": "stop"}

Delete a scan

With the known scan_id, a scan can be deleted. The scan must not be running. So it must be either stopped before or finished. In case of the new scanner API it could also be in the stored status.

With OSP

xml
<delete_scan scan_id='97079ee9-8917-49da-aa4f-4ef95f757ac1'/>

With Scanner API

For deleting a scan, the DELETE method is used on the scan URL containing the scan ID.

cmd
Method: DELETE
Endpoint: /scans/{scan_id}

Parameter scan_id: is de Scan ID

Fetching results

Knowing the scan id, it is possible to fetch results. This command allows some options, like fetching just an amount of results.

With OSP

It is possible to tell OSPd if it must remove or preserve in memory the results. Also, it is possible to specify the max amount of results to be fetch.

xml
<get_scans scan_id='97079ee9-8917-49da-aa4f-4ef95f757ac1' pop_results='1' max_results='10'/>

With Scanner API

Results in Openvasd are stored with a result ID. This ID is useful to fetch results by ranges. Giving no ranges, all results are included in the response.
Results are not removed until the whole scan is deleted. Therefore it is necessary to specify the range of results if you want to fetch a given amount of results with out duplicate them in the responses. Passing a single number you get all results starting from the given result ID, or you can pass a range with start-end to fetch a max amount of results

cmd
Method: GET
Endpoint: /scans/{scan_id}/results?range=0-9

Parameter scan_id: is de Scan ID.
Optional Query: ?range=start-end, where end is optional as well.

Scan status and progress

With OSP

OSP returns the scan status details in the response of same get_scans command for fetching results. Also, it is possible to get some scan progress information passing an argument to the command.

xml
<get_scans scan_id='97079ee9-8917-49da-aa4f-4ef95f757ac1' details='0' progress='1'/>

With Scanner API

Scanner API has a dedicated command for get the status and progress.

cmd
Method: GET
Endpoint: /scans/{scan_id}/status

Parameter scan_id: is de Scan ID

Feed check

With OSP

This command performs some test and check if the feed lock file is in use or not. There is no equivalent command for Scanner API.

xml
<check_feed/>

With Scanner API

Although, there is some commands to test openvasd's health. Ready, will respond with 200 OK if the feed is already uploaded. These commands also provide the current feed version.

cmd
Method: GET
Endpoint: /health/ready 
       or /health/alive
       or /health/started

Get VTs

Get a list of Vulnerability test present in the current feed. This includes Notus and NASL tests.

With Osp

You can get the whole feed, a single VT, or filter by family or modification date. "Details" shows the script dependency as OID or script name.

xml
<get_vts vt_id='1.3.6.1.4.1.25623.1.1.5.2014.322' details='1'/>
<get_vts filter='modification_time>1706848198' details='1'/>

With Scanner API

It is possible to get a list of supported OIDs, the whole feed information or information of a single VT. Filters are not implemented/supported.

cmd
Method: GET
Endpoint: /vts 
          /vts?information=bool
          /vts/{script_oid}

Parameter script_oid: get the metadata for the given script OID.
Optional Query: ?information=bool shows the whole feed metadata.

Get Version

With Osp

A list of versions is returned (feed version,OSPd version, OSP protocol version, openvas version)

xml
<get_version/>

With Scanner API

Only the feed version and the HTTP version are available.

cmd
Method: HEAD

Get scanner details

Return details about the scanner

With Osp

Return a Scanner description and the scanner preferences.

xml
<get_scanner_details/>

With Scanner API

Return a list of scanner preferences.

cmd
Method: GET
Entrypoint: scans/preferences

Get sensor performance

Return system report. There is currently no equivalent command for Scanner API

With Osp

More information about this command GOS GVMCG

xml
<get_performance start='1706848198' end='1706848198' title='CPU'/>

Rust Doc Progress Calculation (`rust/doc/progress-calculation.md`)

Scan Progress Calculation

The scan progress is calculated based on the number of launched plugins over the total number
of plugins per host. This is the simplest case when a scan has a single host target. Other
factors change the equation: multiple hosts, excluded hosts, and dead hosts.

The required information is always provided by openvasd via the route GET /scans/{scan-id}/status.

Host Info Fields

The status response contains a host_info object:

json
{
  "start_time": 1709111465,
  "end_time": 1709111496,
  "status": "running",
  "host_info": {
    "all": 12,
    "excluded": 3,
    "dead": 2,
    "alive": 1,
    "queued": 0,
    "finished": 1,
    "scanning": {
      "127.0.0.1": 12,
      "127.0.0.3": 75
    }
  }
}

The fields have the following meaning:

  • all: Total number of hosts to be scanned after clean-up (duplicates, unresolvable, and
    disallowed hosts removed). Sent once at the beginning of the scan.
  • excluded: Number of hosts excluded from scanning as reported by openvasd. This may
    differ from what the client submitted, because openvasd can detect duplicate or disallowed
    hosts. Always use the value provided by openvasd, not the client-submitted one.
  • dead: Number of hosts found to be dead. With Boreas, this is known at scan start, but
    can increase as hosts that were initially alive may die during the scan. The client must
    update this count each time a new dead host is reported.
  • alive: Number of hosts that have been fully scanned and successfully finished.
  • queued: Number of hosts waiting to be scanned.
  • finished: Same as alive for the OpenVAS scanner: both reflect hosts that completed
    scanning. Clients should use alive for the progress formula.
  • scanning: Map of host address to scan progress (0–100). Once a host reaches 100 % it is
    removed from this map and alive is incremented. A value of -1 means the host was found
    dead during scanning and dead is incremented instead.

Progress Formula

text
scan_progress = (sum(scanning.values) + 100 * alive) / (all - dead)

Special Case: Resuming a Scan

When resuming a stopped scan, already-finished hosts must not be scanned again. They are
therefore passed as excluded_hosts when creating the new scan. See resume scan
for details on how to set that up.

Because those hosts are now excluded, the new scan starts with all reduced by the number of
previously finished hosts and its progress would incorrectly begin at 0 %. To compensate, the
client must track previously_finished and factor them into the formula.

Example

The original scan had 15 hosts, 3 excluded, and 1 host had fully finished before the scan was
stopped. When resuming, that finished host is added to excluded_hosts. At the start of the
resumed scan openvasd reports:

json
{
  "host_info": {
    "all": 11,
    "excluded": 4,
    "dead": 2,
    "alive": 0,
    "queued": 9,
    "finished": 0,
    "scanning": {}
  }
}

The client knows previously_finished = 1. The adjusted formula is:

text
scan_progress = (sum(scanning.values) + 100 * (alive + previously_finished))
              / (all + previously_finished - dead)

So at the very start of the resumed scan:

text
scan_progress = (0 + 100 * (0 + 1)) / (11 + 1 - 2) = 10 %

The resumed scan therefore starts at 10 % rather than 0 %, correctly reflecting the work
already done.

Rust Doc Result Oid Keys (`rust/doc/result-oid-keys.md`)

Used keys for internal messages

Under some circumstances we need to send out results as either:

  • Log
  • Error
    to the client although there is no script with a proper OID generating them.

For those cases we introduced special keys in the form of
$SERVICE/$COMPONENT
in openvasd the service is always openvasd while the component may differ.

Currently the keys

  • openvasd/container-image-scanner - contains messages from the container-image-scanner component

are implemented.

Rust Doc Resume Scan (`rust/doc/resume-scan.md`)

How do I resume a scan?

Although openvasd just has the start and stop actions, you can resume a stopped task by creating a new scan and providing finished hosts within exclude_hosts.

To do that, you start a scan, collect all results with the type host_end, and then stop the scan. Next, you create a new scan with the ip_address of the already finished scans in exclude_hosts.

As an example, we create a scan to scan the hosts 127.0.0.1, localhost with the following scan.json:

json
{
  "target": {
    "hosts": [
      "127.0.0.1",
      "localhost"
    ],
    "ports": [
      {
        "protocol": "tcp",
        "range": [
          {
            "start": 22,
            "end": 22
          }
        ]
      }
    ],
    "credentials": [
      {
        "service": "ssh",
        "port": 22,
        "up": {
          "username": "noname",
          "password": "nopass"
        }
      }
    ]
  },
  "vts": [
    {
      "oid": "1.3.6.1.4.1.25623.1.0.90022"
    }
  ]
}

we create the scan and start it:

sh
curl -k --cert $CERT --key $KEY "https://localhost/scans" -d @scan.json
curl -k --cert $CERT --key $KEY "https://localhost/scans/$ID" -d "{ \"action\": \"start\"}"
curl -k --cert $CERT --key $KEY "https://localhost/scans/$ID"

The results contain something like:

json
...
  {
    "id": 2,
    "type": "host_end",
    "ip_address": "127.0.0.1",
    "oid": "",
    "message": "Mon Feb 19 13:54:07 2024"
  }
...

The type host_end indicates that a host was scanned.

Then we stop it:

sh
curl -k --cert $CERT --key $KEY "https://localhost/scans/$ID" -d "{ \"action\": \"stop\"}"

We assume that when we stopped it, it just scanned 127.0.0.1, so we create a scan with it excluded in hosts:

json
{
  "target": {
    "hosts": [
      "localhost"
    ],
    "excluded_hosts": [
      "127.0.0.1"
    ],
    "ports": [
      {
        "protocol": "tcp",
        "range": [
          {
            "start": 22,
            "end": 22
          }
        ]
      }
    ],
    "credentials": [
      {
        "service": "ssh",
        "port": 22,
        "up": {
          "username": "noname",
          "password": "nopass"
        }
      }
    ]
  },
  "vts": [
    {
      "oid": "1.3.6.1.4.1.25623.1.0.90022"
    }
  ]
}

when creating the new scan and starting it, it should not scan 127.0.0.1 again.

sh
curl -k --cert $CERT --key $KEY "https://localhost/scans" -d @scan.json
curl -k --cert $CERT --key $KEY "https://localhost/scans/$ID" -d "{ \"action\": \"start\"}"
curl -k --cert $CERT --key $KEY "https://localhost/scans/$ID"

This is mainly useful when you scan ip ranges.

Doc Manual Nasl Nasl Changes (`doc/manual/nasl/nasl-changes.md`)

Breaking changes in next version

A list of breaking changes we might want to do in a future NASL version.

Autoconversion

  • Simplify the autoconversion rules (i.e. strings magically being turned into integers, arrays into bools and so on, ...). Prefer throwing errors over implicit conversions.

Obsolete operators

Get rid of barely used operators such as the x operator and >>>=.

Control flow

Disallow using break to escape from functions/the script.

Forking

Remove the forking concept altogether.

FCT_ANON_ARGS

Think of a cleaner construct to allow variadics.

Implicit variable creation

Multiple operations currently implicitly create a variable if it was not defined before the operation. Example: Increment/Decrement operators, array indexing. a++ will implicitly create a variable a and initialize it to zero.
The proposed change makes code referencing a non-existent variable return an error instead.

Variable owner scope

NASL C interpreter handles variables in local or global scopes. A variable created and set inside e.g. in an if scope, it can be accessed from outside the scope. The proposed change makes the code to remove the variable once the scope is dropped. The new behavior is already implemented under the naslv2 feature. Default is nasl v1, for backward compatibility.

Doc Manual Nasl Nasl Grammar (`doc/manual/nasl/nasl-grammar.md`)

NASL Grammar

Preliminary remarks

  • Comments start with a # and finish at the end of the current line.

Statements

A NASL program is a list of statements. Statements are delimited by semicolons, although semi-colons may be omitted after block-statements (such as loops, ifs, function declarations, ...).
A statement is any of the following:

  • Function declaration: function identifier ( arguments ) { block }
  • An expression statement: expr
  • if block: if ( expr ) { block } else if (expr ) { block } else { block }
  • for loop: for ( func; expr; func; ) { block }
  • while loop: while ( expr ) { block }
  • repeat loop: repeat instr until expr
  • foreach loop: foreach identifier ( array ) { block }
  • include statement: include( "file.inc" )
  • local variable: local_var variable
  • global variable: global_var variable
  • control flow via break / continue / return ( expr )

Expressions

An expression can be one of the following:

  • Atom: A base expression such as a literal, identifier, or function call.
  • Binary: A binary operation (e.g., a + b).
  • Unary: A unary operation (e.g., -a or !b).
  • Assignment: An assignment expression (e.g., x = y)
  • Increments: Similarly, increments are also allowed (e.g. ++x or y++)

Atoms

An Atom is a fundamental expression type with no further decomposition (other than subexpressions). It includes:

  • Literals: Primitive values (e.g., integer, string, etc.).
  • Variables: A variable name.
  • Arrays: An array literal (e.g. [1, 2, 3])
  • Array access: An expression accessing an array element (e.g. arr[0])
  • Function calls: A function call (for example f(x, y))

Literals
A literal may be any of

  • Boolean: FALSE or TRUE.
  • Integer: 100, 0b010101 (binary, leading 0b), 01234567 (octal, leading 0), 0xff (hex, leading 0x).
  • Strings: Enclosed in ", for example "foo".
  • Byte arrays: Similar to strings, but enclosed in ', i.e. 'foo'.
  • Arrays: For example [1, 2, 3].
  • Null: NULL.
  • IP addresses: For example 127.0.0.1.

Function calls
Function calls are written as fn_name (args), where args is a comma separated list of named arguments given as arg1: val1, arg2: val2, arg3: val3, .... In special cases (for some builtin functions) unnamed arguments are also accepted, i.e. fn_name (val1, val2, val3, ...).
x operator
This deprecated syntax allows repeating the previous function calls n times, i.e. fn_name(args) x 100 will repeat fn_name 100 times.

Array access
Indexing into arrays/array-likes (such as strings) is done by [index], e.g. foo[5].

Unary expressions

A unary expression is any expression preceded by a unary operator, such as !x or -y. Available unary operators are
-: Integer negation.
+: For integers, leaves the value modified.
!: Boolean not.
~: Bitwise not.

Binary exprs

A binary expression is two expressions along with a binary operator, such as x + y or a && b.
Available binary operators are:

Arithmetic:

  • + is the addition operator.
  • - is the subtraction operator.
  • * is the multiplication operator.
  • / is the integer division operator.
  • % is the integer modulo (remainder) operator.
  • ** is the power operator.
  • >> and << are bitshift operators. >>> is equivalent to >>, but performs the operation after casting the operands to unsigned integers.
  • & and | are bitwise and/or.
  • ^ is bitwise xor.

Logical:

  • && and || are boolean and/or. The operators short-circuit (i.e. the foo=3 in FALSE && (foo = 3) will not be executed).
  • == is the equals operator.
  • != is the not-equals operator.
  • >, <, >= and <= are greater/less and greater equal / less equal respectively.

Strings

  • >< is the string-match operator. It checks if the LHS contains the RHS as a substring.
  • >!< is the negated string-match operator.
  • =~ is the regex matching operator. It interprets the RHS as a regular expression and checks whether the LHS matches the regular expression.
  • !~ is the negated regex matching operator.
    Note: =~ and !~ support the (standard extended POSIX) regex pattern. See Regular Expression Functions for more background info on the supported regex expression support.

Assignment

An assignment expression is syntactically similar to a binary expression but assigns the RHS expression to the LHS value. The LHS is restricted to valid assignment targets:

nasl
a = 3; // assigns 3 to a
a[1] = 3; // assigns 3 to the second element of a (an array).
"foo" = 3; // ERROR: string literal is not a valid assignment target.

Available assignment operators:
=: Simple assignment.
+=: Adds the RHS to the LHS.
-=: Subtracts the RHS from the LHS.
*=: Multiplies the LHS by the RHS.
/=: Divides the LHS by the RHS.
%=: Computes (LHS % RHS) and assigns it to LHS.
<<=: Computes (LHS << RHS) and assigns it to LHS.
>>=: Computes (LHS >> RHS) and assigns it to LHS.
>>>=: Computes (LHS >>> RHS) and assigns it to LHS.

Increment

An increment expression is syntactically similar to a unary expression and is restricted to valid assignment targets as well:

nasl
a++; // Increments foo by 1
a[1]++; // Increments the second element of a (an array) by 1.
"foo"++; // ERROR: string literal is not a valid assignment target.

Available increment operators:
++: Increments operand by one.
--: Decrements operand by one.

Postfix operators (x++ and x--) evaluate to the value of x, then modify the value. For example, in x = 10; x++;, the second statement evaluates to 10.
Prefix operators (++x and --x) modify the value, then evaluate to the new value. For example, in x = 10; ++x;, the second statement evaluates to 11.

Operator precedence

Operators Associativity
++ -- None
** Right
~- (unary minus) Left
= += -= *= /= %= <<= >>= >>>= Right
! Left
* / % Left
+ - Left
<< >> >>> Left
& Left
^ Left
| Left
< <= > >= == != <> =~ !~ >!< >< None
&& Left
|| Left

Note, in particular, that assignment has relatively high precedence, allowing expressions like

nasl
if (!x = foo() ) { ... }

which will first assign the result of the foo() call to x, and then negate the value.

Loops and Control Flow

If

If statements are written as
if (condition) block where block is either a single statement (in which case enclosing braces may be omitted) or multiple statements (in which case the braces are necessary).

Loops

The following loops exist:

  • While loop: while(cond) block; executes the block as long as the condition is TRUE.
    If the condition is FALSE, the block is never executed.
  • For loop: for (expr1; cond; expr2) block; is similar to the C operator and is equivalent to expr1; while(cond) block; expr2;
  • foreach var (array) block; iterates over all elements in an array or array-like.
  • repeat block; until (cond); executes the blocks as long as the condition is TRUE. The block is executed at least once.
  • break breaks the current loop and jumps at its exit.
    If you are not inside a loop, the behavior is undefined.
  • continue jumps to the next step of the loop.
    If you are not inside a loop, the behavior is undefined.
  • return returns a value from the current function.

Variable Declarations

Variables are declared implicitly upon assignment. For example, a = 1; will declare the variable a even if it did not exist before.

NASL uses global and local variables. Local variables are created in a function and stop existing as soon as the function returns. Global variables exist for the entire script.

In some cases, you might want to make the scope of a new variable explicit:

  1. If you want to write into a global variable from within a function.
  2. If you want to be sure that you are declaring a new local variable and not overwriting a global variable with the same name.

In these cases, a variable can explicitly be declared as follows:

  • local_var var;
  • global_var var;

Function Declarations

Functions are declared via

nasl
function fn_name (arg1, arg2, arg3, ...) {
}

Any arguments in user-defined functions are named arguments, that is, they need to be explicitly named at the call site:
fn_name (arg1: 1, arg2: "foo", arg3: FALSE)

Types

NASL handles the following data types:

  • Boolean
  • Integer
  • Strings
  • Data (strings represented as raw bytes)
  • Arrays
  • Null

Current behavior

Type autoconversion

Booleans
Every type is automatically converted into booleans when a boolean is needed (for example in if (x) { ... })

  • The undefined or null value is false
  • All integers except 0 are true
  • Strings are true if not empty and not "0".
  • Arrays are always true whether they are empty or not

NULL
NULL and the array operator Reading an array element from a NULL value will immediately convert it into an array. An empty array of course, but no more an undefined variable.. For example:

text
v = NULL;
# isnull(v)=TRUE and typeof(v)="undef"
x = v[2];
# isnull(x)=TRUE and typeof(x)="undef"
# But isnull(v)=FALSE and typeof(v)="array"

NULL and isnull If it should be checked whether a variable is undefined, isnull(var) has to be used. Testing the equality with the NULL constant (var == NULL) is not a good idea as NULL will be converted to 0 or the empty string "" according to the type of the variable. This is necessary to ensure that variables are "automatically initialized" – changing this would probably break some existing scripts.

String
For binary operators:

  • If one of the arguments is NULL, + returns the other one.
  • If one of the arguments is a string, the other argument is converted to a string.
  • If one of the arguments is an integer, the other is converted to an integer.
  • In any other case, NULL is returned.

Special Behavior

  • break can (but should not) be used to exit from a function or the script.OB
  • The “magical strings” from NASL1 have been removed. In NASL1, adding a string to an integer might give an integer if the string contained only digits.
  • The minus operator follows the same type conversion rules as plus.
  • Using uninitialized variables is bad. However, to ensure that old scripts still work, the NULL undefined value will be converted to 0 or “” according to the context (integer or string). That is why isnull has to be used to test if a variable is undefined. See “Warnings about the NULL value” in NASL Documentation.

Retrieving Function Arguments

The _FCT_ANON_ARGS variable exists in order to allow access to anonymous function args from within a function.
This variable will be NULL in interpreters below NASL_LEVEL 2190.

The following may be put at the start of scripts that need this function:

text
if (NASL_LEVEL < 2190) exit(0); # _FCT_ANON_ARGS is not implemented
  1. Writing to _FCT_ANON_ARGS is undefined. Currently, the memory is wasted but the value cannot be read back.
  2. Using _FCT_ANON_ARGS to try to read named arguments is bad too. Currently, there is a protection and a NULL value is returned.

Doc Manual Nasl Openvas Nasl Lint (`doc/manual/nasl/openvas-nasl-lint.md`)

openvas-nasl-lint(1)

NAME

openvas-nasl-lint - OpenVAS standalone NASL linter

SYNOPSIS

openvas-nasl-lint [option...] nasl_file...

DESCRIPTION

OpenVAS is a framework of several services and tools offering a
comprehensive and powerful vulnerability scanning and vulnerability
management solution.

openvas-nasl-lint is linter targeted at the NASL language.

OPTIONS

These programs follow the usual GNU command line syntax, with long
options starting with two dashes (`-'). A summary of options is
included below.

-h, --help

: Show summary of options.

-d, --debug

: Output debug log messages.

-l file, --nvt-list file

: Process files from file.

-i dir, **--include-dir dir

: Search for includes in dir.

--strict-includes

: Enable check for strict include order.

SEE ALSO

openvas(8), openvas-nasl(1)

Doc Manual Nasl Openvas Nasl (`doc/manual/nasl/openvas-nasl.md`)

openvas-nasl(1)

NAME

openvas-nasl - OpenVAS standalone NASL interpreter

SYNOPSIS

openvas-nasl [option...] file...

DESCRIPTION

openvas-nasl executes a set of NASL scripts against a given target
host. It can also be used to determine if a NASL script has any syntax
errors by running it in parse (-p) or lint (-L) mode.

OPTIONS

-T tracefile, --trace tracefile

: Make nasl write verbosely what the script does in the file
tracefile , ala 'set -x' under sh, pass '-' to send the output
to stderr.

-t target, --target target

: Apply the NASL script to target which may be a single host
(127.0.0.1), a whole subnet (192.168.1.0/24) or several subnets
(192.168.1.0/24, 192.168.243.0/24).

-e iface, --source-iface iface

: Specify the network interface to be used as the source for
established connections.

-s, --safe

: Set the return value of safe_checks() to 1. (See the OpenVAS
Scanner documentation to know what the safe checks are) Implies
-B.

-D, --description

: Only run the description part of the script.

-B, --both

: Run in description mode before running the script.

-p, --parse

: Only parse the script, don't execute it.

-L, --lint

: Lint the script (run extended checks).

-X, --disable-signing

: Run the script with disabled signature verification.

-i dir, --include-dir dir

: Search for includes in dir.

-h, --help

: Show help.

-V, --version

: Show the version of NASL.

-d, --debug

: Output debug information to stderr.

-r port-range, --port-range port-range

: This is the default range of ports that the scanner plugins will
probe. The syntax of this option is flexible, it can be a single
range ("1-1500"), several ports ("21,23,80"), several ranges
of ports ("1-1500,32000-33000"). Note that you can specify UDP
and TCP ports by prefixing each range by T or U. For instance, the
following range will make openvas scan UDP ports 1 to 1024 and TCP
ports 1 to 65535 : "T:1-65535,U:1-1024".

-k key=value, --kb key=value

: Set KB key to value. Can be used multiple times.

SEE ALSO

openvas(8), openvas-nasl-lint(1)

HISTORY

NASL comes from a private project called 'pkt_forge', which was
written in late 1998 by Renaud Deraison and which was an interactive
shell to forge and send raw IP packets (this pre-dates Perl's
Net::RawIP by a couple of weeks). It was then extended to do a wide
range of network-related operations and integrated into the scanner as
'NASL'.

The parser was completely hand-written and a pain to work with. In
Mid-2002, Michel Arboi wrote a bison parser for NASL, and he and Renaud
Deraison re-wrote NASL from scratch. Although the "new" NASL was
nearly working as early as August 2002, Michel's laziness made us wait
for early 2003 to have it working completely.

After the original authors decided to stop the Open Source development
in 2005, most changes and maintenance works were done by Greenbone
Networks.

AUTHOR

Most of the engine is (C) 2003 Michel Arboi, most of the built-in
functions are (C) 2003 Renaud Deraison. Most new code since 2005
developed by Greenbone AG.

Doc Manual Openvas Openvas Ipc Protocol (`doc/manual/openvas/openvas_ipc_protocol.md`)

OpenVAS IPC Protocol

This protocol allows the communication between parent and child process in the openvas-scanner. The information is sent in json format.

Data Handling

The data to be sent/retrieve is stored inside a structure with two fields: data_type and an union of different data members

c
struct ipc_data
{
  enum ipc_data_type type;
  union
  {
    ipc_user_agent_t *ipc_user_agent;
    ipc_hostname_t *ipc_hostname;
    ipc_lsc_t *ipc_lsc;
  };
};

Data types

Currently, the following data types are supported

  • User-Agent: First time that the User-Agent is used during a scan, it will be sent to the parent process and stored for further usage.
  • Hostname: Hostnames which are found for a plugin are communicated the parent process and added to the vhost list. Later launched plugins know the updated list.
  • LSC: The gather-package-list.nasl nasl script gathered the necessary data for running a LSC scan. The parent process is told to run the scan.

The enum ipc_data_type has also the IPC_DT_ERROR definition for unknown types.

c
enum ipc_data_type
{
  IPC_DT_ERROR = -1,
  IPC_DT_HOSTNAME = 0,
  IPC_DT_USER_AGENT,
  IPC_DT_LSC,
};

Data

Currently, there are three data holders, which correspond to the supported data types. This data is not directly accessible, and functions must be used to set/get the data.

  • ipc_hostname: used to send / retrieve new hostnames.
c
struct ipc_hostname
{
  char *source;        // source value
  char *hostname;      // hostname value
  size_t source_len;   // length of source
  size_t hostname_len; // length of hostname
};
  • ipc_user_agent: used to send/retrieve new hostnames.
c
struct ipc_user_agent
{
  char *user_agent;      // user_agent value
  size_t user_agent_len; // length of user_agent
};
  • ipc_lsc: used to send/retrieve the LSC data_ready flag.
c
struct ipc_lsc
{
  gboolean data_ready; // flag indicating that lsc data is in the kb
};

Messages

Before sending a message to another process, the message must be created in the right json format.

The following examples show how the Json message looks like for the different data types.

  • ipc_hostname:
text
{
  "type":0,
  "source":"TLS certificate",
  "hostname":"localhost"
}
  • ipc_user_agent:
text
{
  "type":1,
  "user-agent":"Orange Agent"
}
  • ipc_lsc:
text
{
  "type":2,
  "data_ready":"True"
}

The following code shows how to use the different functions for ipc communication:

c
#include <stdio.h>
#include <openvas/misc/ipc_openvas.h>

int
main(int argc, char **argv)
{

  ipc_data_t *data_s = NULL;
  ipc_data_t *data_r = NULL;
  gchar *hn = "localhost";
  gchar *hns = "TLS certificate";

  // Prepare data to be sent
  data_s = g_malloc0 (sizeof (ipc_data_t *));
  data_s = ipc_data_type_from_hostname (hns, strlen (hns), hn, strlen(hn));

  char *json = ipc_data_to_json(data_s);
  printf ("\nPrint json message:\n%s\n\n\n", json);


  // Read received data
  data_r = g_malloc0 (sizeof (ipc_data_t *));
  data_r = ipc_data_from_json (json, strlen (json));

  printf ("Print data received in the json string:\n"
          "hostname: %s\n"
          "source: %s\n",
          ipc_get_hostname_from_data (data_r),
          ipc_get_hostname_source_from_data (data_r));
}

Sending and retrieving IPC messages.

Inter-process communication is done using pipes. Therefore, an IPC context is initialized when a new process is created. This opens the pipe and the child inherits the file descriptors, stablishing the communication between parent and child process.

Each process has an IPC context, which is de following data structure. The variable context
contains the two files descriptors (read/write) created and used for pipe communication.

c
struct ipc_context
{
  enum ipc_protocol type;
  enum ipc_relation relation;
  unsigned int closed;
  pid_t pid;
  void *context;
};

see src/processes.c:create_ipc_process()

Sending a message

Since the processes have an IPC context, calling the function ipc_send() is enough to send an IPC message to another process.

The following example can be find in the file src/misc/user_agent.c, where the IPC message in jso format is encapsulated in the ipc data structure (includes the type of message) and sent to the parent process.

c
static void
send_user_agent_via_ipc (struct ipc_context *ipc_context)
{
  struct ipc_data *ua = NULL;
  const char *json = NULL;

  ua = ipc_data_type_from_user_agent (user_agent, strlen (user_agent));
  json = ipc_data_to_json (ua);
  ipc_data_destroy (ua);
  if (ipc_send (ipc_context, IPC_MAIN, json, strlen (json)) < 0)
    g_warning ("Unable to send %s to host process", user_agent);
}

Retrieving a message

For retrieving a message, it is quite similar to sending one. Having a context, it is just necessary to call ipc_retrieve() function. This will return the ipc data structure containing the message type and the information in json format to be processed.

An example of usage can be seen in src/attack.c:read_ipc()

c
static void
read_ipc (struct ipc_context *ctx)
{
  char *result;
  ipc_data_t *idata;

  while ((result = ipc_retrieve (ctx, IPC_MAIN)) != NULL)
    {
      if ((idata = ipc_data_from_json (result, strlen (result))) != NULL)
        {
          switch (ipc_get_data_type_from_data (idata))
            {
            case IPC_DT_ERROR:
              g_warning ("%s: Unknown data type.", __func__);
              break;
            case IPC_DT_HOSTNAME:
              if (ipc_get_hostname_from_data (idata) == NULL)
                g_warning ("%s: ihost data is NULL ignoring new vhost",
                           __func__);
              else
                append_vhost (ipc_get_hostname_from_data (idata),
                              ipc_get_hostname_source_from_data (idata));
              break;
...

Doc Manual Openvas Scanner Run Loop (`doc/manual/openvas/scanner-run-loop.md`)

OpenVAS scanner run-loop

Click to open scanner-run-loop

Doc Manual Openvas Redis Redis Config (`doc/manual/openvas/redis/redis_config.md`)

Redis KB server

Presentation

Redis is used to store and access the KB (Knowledge Base).
Scans won't run if they cannot access the server and might be significantly
slowed down if redis is not properly configured.

The feature has been developed with neither cluster mode nor replication
enabled. Redis 3.2 and higher are supported.

Connection

OpenVAS can currently only access redis via a unix socket. This choice has been
made for the sake of speed and security. No authentication is supported yet, we
rely on filesystem permissions to protect the KBs.

The path to the unix socket is /run/redis-openvas/redis.sock by default, and
can be changed using the db_address parameter.

On the redis side, use the following directives:

text
port 0 # prevent redis from listening on a TCP socket
unixsocket /run/redis-openvas/redis.sock
unixsocketperm 770
timeout 0

Database number

Multiple KBs can be served in parallel, for multiple hosts scanned by one or
several tasks. This is done using redis databases, which are independent
namespaces. The DB#0, which is where every new connected client starts, is
reserved and used to schedule concurrent accesses to the available namespaces.
It contains a single variable, called GVM.__GlobalDBIndex. This variable
is a bitmap of the different namespaces. When opening a new DB, the scanner will
look for the first bit that is not set, starting from 1 to the maximum number of
available DBs. If none is found, the scanner will enter a wait and retry loop.
Otherwise, it will (atomically, along with the check) set the bit to 1 and
switch to the selected namespace.

It is therefore important that redis exports enough databases. This number can
be calculated using the following formula:

text
#DB = 1 + (#of parallel tasks) * (#of parallel hosts)

The desired/needed value should be set to redis.conf, as a databases
directive.

For instance:

text
databases 128

Clients numbers

Redis can limit the number of clients served concurrently. This can be safely
set to a pretty high number. You can estimate the number of clients that the
server will have to serve:

text
#CLI = 1 + (#of parallel tasks) * (#of parallel hosts) * (#of concurrent NVTs)

For instance:

text
maxclients    512

Volatile keys

An expire may be set by openvas for keys which may not be absolutely necessary.

A maxmemory-policy can be chosen in conjunction with maxmemory.
When the memory limit is reached Redis will try to remove keys according
to the eviction policy selected. Both options can be set via the redis.conf
file. See the reference config
for further documentation of these options.

If no maxmemory and maxmemory-policy is chosen the redis memory may
increase until the OS runs out of memory.

Only downside of these options is that when maxmemory is reached and there
are no more keys to evict then no keys are added to redis anymore.
This is done without notice and may lead to missing or incomplete results.

Debugging and monitoring a scan via redis

Once redis-server is started, you can issue the following command to see
everything that happens during the execution.

sh
$ redis-cli -s <path to the redis server socket> MONITOR

The default path is /run/redis-openvas/redis.sock. Then start the scan or
openvas-nasl. You should be able to follow precisely the interactions
between the scanner and the KB server.

See also: https://redis.io/docs/latest/commands/monitor/

To enter an interactive mode type

text
$ redis-cli -s <path to the redis server socket>

redis /run/redis-openvas/redis.sock> keys *
1) "OpenVAS.__GlobalDBIndex"

redis /run/redis-openvas/redis.sock> select 1
OK

Then you can search for keys with a pattern (*"keys " will dump all
keys present):

text
redis /run/redis-openvas/redis.sock[1]> keys "*ALARM*"

Note that keys will disappear once a scan of a host finished.
When the scanner is not active, the store is empty.

The keys contain sets, not strings. So instead of the get command
you need to use smembers to view the content:

text
redis /run/redis-openvas/redis.sock[1]> smembers Sun/VirtualBox/Lin/Ver
1) "4.3.12.93733"

Doc Manual Openvas Redis Redis Data Model (`doc/manual/openvas/redis/redis_data_model.md`)

Redis Data Model for OpenVAS

This document explains the current Redis structures as used by OpenVAS.

Please refer to redis_config.md on how to configure and
manage the redis service.

Having an empty Redis (flushed), when OpenVAS starts, two Redis DBs are
taken into use. These are DB 0 and DB 1, which are permanent stores and they
are never deleted or flushed by OpenVAS.

DB 0: In-Use List

In DB 0 there is only one hash type entry called GVM.__GlobalDBIndex. In this
hash is stored a list of in-use DBs. As this is the initial DB, OpenVAS
never tries to take it for another purpose. Each time in which OpenVAS
needs to set a new KB, it will start to search from DB 1.

We can see this with the command line client redis-cli:

text
$ redis-cli -s /run/redis-openvas/redis.sock

redis /run/redis-openvas/redis.sock> SELECT 0
OK

redis /run/redis-openvas/redis.sock> KEYS *
1) "GVM.__GlobalDBIndex"

redis /run/redis-openvas/redis.sock> HGETALL GVM.__GlobalDBIndex
1) "1"
2) "1"

With the last command HGETALL we get the key-value tuples saved into the
hash. In this case we can see that there is a key named “1” (item 1) and the
value for this key is also “1” (item 2). All this means that the DB 1 is in
use. Another way to see the same is using the command
HGET GVM.__GlobalDBIndex 1 to check directly if there is a key named “1” in
the hash. If the key exist, we will get the value stored there.

text
redis /run/redis-openvas/redis.sock> HGET GVM.__GlobalDBIndex 1
"1"

redis /run/redis-openvas/redis.sock> HGET GVM.__GlobalDBIndex 2
(nil)

As can be seen, there is no key 2 set.

DB 1: NVTI Cache

In DB 1 is stored the NVT’s metadata (what before was in .nvti files) and
other information such as NVT’s timestamps and Checksums, for signature
verification.

text
redis /run/redis-openvas/redis.sock[3]> SELECT 1
OK

redis /run/redis-openvas/redis.sock[1]> KEYS *
     1) "nvt:1.3.6.1.4.1.25623.1.0.901173"
     2) "nvt:1.3.6.1.4.1.25623.1.0.120201"
     3) "filename:2017/gb_ubuntu_USN_3384_2.nasl:oid"
     4) "filename:pre2008/roxen_counter.nasl:timestamp"
     5) "filename:2015/ELSA-2011-0328.nasl:timestamp"
     …

Each nvt:OID entry is a list which stores the NVT’s metadata, while the
other ones are set types.

DB 2 .. DB N: Temporary KB for tasks and single scanned host

To run a task, OpenVAS needs some data, like the target (single hosts, multiple
hosts, a network) and the port list, a list of plugins to be launched and other
necessary data to perform the scan. When OpenVAS is started, it gets an scan-id
as command parameter.

text
openvas --scan-start=<scan-id>

Temporary KB for task

When OpenVAS is started, it takes all the necessary data from a KB. This KB is
filled by OSPD-OpenVAS, and OpenVAS found this KB because it has a key with
the scan-id. This is the way in which an OpenVAS process found the KB to perform
its task.
Each single task has each own main kb with the data necessary for running the scan
and this KB is released once the complete scan ended. This means, when all
single hosts in the target were scanned, the main kb data will be deleted
and the in-use DB list inside the hash GVM.__GlobalDBIndex is updated.

The task main KB is used for storing the results. Each result produced by NVTs
as well as the the progress status of the currently scanned hosts will be stored
in this KB.

Temporary KB for a single host

Each host to be scanned takes a new DB for the KB. The host KB is used to
store some scan preferences and results for this specific host. When the host
scan finished, the KB and thus the DB is deleted with all its content and
freed. Then, the in-use DB list inside the hash GVM.__GlobalDBIndex is
updated.

Data Content Examples

Before starting a task

text
DB 0 -> 1) "GVM.__GlobalDBIndex" -> "1" "1"

DB 1 -> 1) "filename:2016/gb_fedora_2016_d957ffbac1_webkitgtk4_fc23.nasl:oid"
        2) "filename:2013/gb_fedora_2013_19285_java-1.7.0-openjdk_fc18.nasl:timestamp"
        3) "nvt:1.3.6.1.4.1.25623.1.0.882624"
        4) "nvt:1.3.6.1.4.1.25623.1.0.901039"
        5) "nvt:1.3.6.1.4.1.25623.1.0.863661"
        .
        .
        .
        134997) "nvt:1.3.6.1.4.1.25623.1.0.10613"
        134998) "filename:2017/gb_imagemagick_info_disc_n_sec_bypass_vuln_macosx.nasl:oid"
        134999) "filename:2017/gb_fedora_2017_cf1944f480_libpng15_fc25.nasl:oid"
        135000) "filename:2015/gb_junos_cve-2014-6386.nasl:timestamp

DB 2 -> (empty list or set)

After loading the data to start a scan

In DB 2 can be seen some internal/* keys. While almost all keys are used for
internal communication between OpenVAS and OSPD-OpenVAS, only
'internal//scanprefs' has the data necessary to run the scan.

text
DB 0 -> 1) "GVM.__GlobalDBIndex" -> "1" "1"
                                 -> "2" "1"

DB 1 -> 1) "filename:2016/gb_fedora_2016_d957ffbac1_webkitgtk4_fc23.nasl:oid"
        2) "filename:2013/gb_fedora_2013_19285_java-1.7.0-openjdk_fc18.nasl:timestamp"
        3) "nvt:1.3.6.1.4.1.25623.1.0.882624"
        4) "nvt:1.3.6.1.4.1.25623.1.0.901039"
        5) "nvt:1.3.6.1.4.1.25623.1.0.863661"
        .
        .
        .
        134997) "nvt:1.3.6.1.4.1.25623.1.0.10613"
        134998) "filename:2017/gb_imagemagick_info_disc_n_sec_bypass_vuln_macosx.nasl:oid"
        134999) "filename:2017/gb_fedora_2017_cf1944f480_libpng15_fc25.nasl:oid"
        135000) "filename:2015/gb_junos_cve-2014-6386.nasl:timestamp

DB 2 -> 1) "internal/dbindex"
        2) "internal/ovas_pid"
        3) "internal/acc04534-54b4-4137-a78a-c3d4441ede37"
        4) "internal/scanid"
        5) "internal/acc04534-54b4-4137-a78a-c3d4441ede37/scanprefs"
        6) "internal/dd91d963-d71f-4c98-bc18-c6fae29633aa/globalscanid"

After starting OpenVAS, during One Scan With One Host

text
/* Detailed source-code truncated for AI context efficiency. */

During One Scan With Two Hosts

text
/* Detailed source-code truncated for AI context efficiency. */

During Two Scans With Each One Hosts

text
/* Detailed source-code truncated for AI context efficiency. */

During Two Scans With Each Two Hosts

text
/* Detailed source-code truncated for AI context efficiency. */

Doc Manual Nasl Built In Functions Built In Plugins Plugin Run Find Service (`doc/manual/nasl/built-in-functions/built-in-plugins/plugin_run_find_service.md`)

plugin_run_find_service(3nasl)

NAME

plugin_run_find_service - find services that are accessible on the target system

SYNOPSIS

void plugin_run_find_service();

plugin_run_find_service takes no arguments.

DESCRIPTION

This function is a built-in plugin, which scans the target for any accessible services.

This function will fork for every vHost on the target and scans the whole port range (1-65535). These ports are split between a configurable number of child processes (default is 6). For each port it is then checked if there is a service running. For almost every found service a result of type INFO is generated and the key Service/\[port\] is set to its port and the key Known/tcp/[port] is set to an identification name. For some services additionally the server banner is saved at [name]/banner/[port].

To detect the services this function tries to get some information first:

  1. Any raw data of a banner saved on the currently scanned port, which is saved at BannerHex/[port]. This data is then transformed into a readable form.
  2. If the first one fails, this function tries to open a stream connection and reads the banner got from this connection.
  3. This banner is then tested for know patterns for different services

These services can be currently detected:

Service name Result is generated Banner is saved Additional Information
chargen Yes No
echo Yes No
http-rpc-epmap Yes Yes
ncacn_http Yes Yes
vnc Yes Yes
nntp Yes Yes
swat No No
vqServer-admin No No
mldonkey Yes No
www Yes Yes http server
AdSubtract Yes Yes
gopher Yes No
realserver Yes Yes
smtp Yes Yes If banner contains postfix, the key smtp/postfix is set to 1
snpp Yes Yes
ftp Yes Yes, if available
ssh Yes No
http_proxy Yes No
pop1 No Yes
pop2 Yes Yes
pop3 Yes Yes
imap Yes Yes
auth Yes No
postgresql Yes No
sphinxql Yes No
mysql Yes No
cvspserver Yes No
cvsup Yes No
cvslockserver Yes No
rsync Yes No
wild_shell Yes (Vulnerability) No
telnet Yes No
gnome14 Yes No
eggdrop Yes No
netbus Yes (Vulnerability) No
linuxconf Yes Yes
finger Yes No
vtun Yes Yes
uucp Yes Yes
lpd Yes No
lyskom Yes No
ph Yes No
time Yes No
iPlanetENS Yes No
citrix Yes No
giop Yes No
exchg-routing Yes Yes
tcpmux Yes No
BitTorrent Yes No
smux Yes No
LISa Yes No
msdtc Yes Yes
pop3pw Yes Yes
whois++ Yes Yes
mon Yes Yes
cpfw1 Yes Yes (kinda??)
psybnc Yes Yes (kinda??)
shoutcast Yes Yes (kinda??)
adsgone Yes Yes (kinda??)
acap Yes Yes
nagiosd Yes No
teamspeak2 Yes No
websm Yes No
ofa_express Yes No
smppd Yes No
upsmon Yes No
sub7 Yes (Vulnerability) No
spamd Yes No
quicktime-streaming-server Yes No
dameware Yes No
SG_ClientAuth Yes No
listserv Yes No
FsSniffer Yes (Vulnerability) No
RemoteNC Yes No
wrapped Yes No the key Known/tcp/[port]is not set
unknown Yes No Unknown service was detected
gnuserv Yes No
issrealsecure Yes No
vmware_auth Yes No
interscan_viruswall Yes No
pppd Yes No
zebra Yes Yes
ircxpro_admin Yes No
gnocatan Yes No
power-broker-master Yes No
dicts Yes No
pNSClient Yes No
VeritasNetBackup Yes No
power-broker-master Yes No fn name mark_pblocald_server, service name duplicated
jabber Yes No
avotus_mm Yes No
socks Yes No The actual service name also contains a number like socks2
DirectConnectHub Yes No
mongodb Yes No

RETURN VALUE

None

Doc Manual Nasl Built In Functions Built In Plugins Plugin Run Openvas Tcp Scanner (`doc/manual/nasl/built-in-functions/built-in-plugins/plugin_run_openvas_tcp_scanner.md`)

plugin_run_openvas_tcp_scanner(3nasl)

NAME

plugin_run_openvas_tcp_scanner - openvas-scanner built-in port scanner

SYNOPSIS

NULL plugin_run_openvas_tcp_scanner();

plugin_run_openvas_tcp_scanner takes no arguments.

Doc Manual Nasl Built In Functions Built In Plugins Plugin Run Synscan (`doc/manual/nasl/built-in-functions/built-in-plugins/plugin_run_synscan.md`)

plugin_run_synscan(3nasl)

NAME

plugin_run_synscan - performs a supposedly fast SYN port scan

SYNOPSIS

NULL plugin_run_synscan();

plugin_run_synscan takes no arguments.

Doc Manual Nasl Built In Functions Cert Functions Cert Close (`doc/manual/nasl/built-in-functions/cert-functions/cert_close.md`)

cert_close(3nasl)

NAME

cert_close - release a certificate object

SYNOPSIS

void cert_close(0: int);

cert_close takes one unnamed argument.

DESCRIPTION

This function releases a certificate object, which was created by cert_open(3nasl) before.

The first unnamed argument is an int and contains an identifier to a cert object. This identifier is returned by cert_open(3nasl).

RETURN VALUE

None

ERRORS

The first unnamed argument is missing

The given object ID is <0

The given object ID is not in use

SEE ALSO

cert_open(3nasl)

Doc Manual Nasl Built In Functions Cert Functions Cert Open (`doc/manual/nasl/built-in-functions/cert-functions/cert_open.md`)

cert_open(3nasl)

NAME

cert_open - create a certificate object

SYNOPSIS

int cert_open(0: string);

cert_open takes one positional argument.

DESCRIPTION

Takes a string/data as unnamed argument and returns an identifier used with the other cert functions. The data is usually the BER encoded certificate but the function will also try a PEM encoding on failure to parse BER encoded one. An opened certificate object must be closed with cert_close(3nasl).

The first unnamed argument is either string or a data object containing the certificate. It is either Binary or PEM encoded.

RETURN VALUE

Identifier for the certificate object as int or NULL on error.

ERRORS

First unnamed argument is missing.

Unable to create certificate object.

SEE ALSO

cert_close(3nasl)

Doc Manual Nasl Built In Functions Cert Functions Cert Query (`doc/manual/nasl/built-in-functions/cert-functions/cert_query.md`)

cert_query(3nasl)

NAME

cert_query - query a certificate object

SYNOPSIS

any cert_query(0: int, 1: string, idx: int);

cert_query takes 2 positional and up to 1 named arguments.

DESCRIPTION

This function runs a command on a given certificate object.

The first unnamed argument is an int containing the certificate ID, given by cert_open(3nasl).

The second unnamed argument is a string containing the command to run on the certificate object. Available commands are:

  • serial - get the serial number of the certificate as a hex string
  • issuer - get the issuer as string in the rfc-2253 format
  • subject - get the subject of the certificate as string in the rfc-2253 format. To query the subjectAltName the named parameter idx with values starting at 1 can be used. In this case the format is either a string in rfc-2253 format, a rfc2822 mailbox name indicated by the first character being a left angle bracket or a S-expression in advanced format for all other types of subjectAltNames which is indicated by an opening parentheses.
  • not-before - get the notBefore time as UTC value in ISO time format (e.g. "20120930T143521")
  • not-after - get the notAfter time as UTC value in ISO time format (e.g. "20280929T143520")
  • all - get all available information in a human readable format, NOT YET IMPLEMENTED
  • hostnames - get an array containing all hostnames listed in the certificate, i.e. the CN part of the subject and all dns-name type subjectAltNames
  • fpr-sha-256 - get the SHA-256 fingerprint of the certificate. The fingerprint is, as usual, computed over the entire DER encode certificate
  • fpr-sha-1 get the SHA-1 fingerprint of the certificate. The fingerprint is, as usual, computed over the entire DER encode certificate.
  • image - get the entire certificate as binary data
  • algorithm-name - get the algorithm name used to sign the certificate. Get the OID of the digest algorithm and translate to a name from a list of Wireshark.
  • signature-algorithm-name - same as algorithm-name
  • public-key-algorithm-name - get the algorithm name of the public key
  • modulus - get the RSA public key's modulus found in the structure of the given cert
  • exponent - get the RSA public key's exponent found in the structure of the given cert
  • key-size - get the size to hold the parameters size in bits, for RSA the bits returned is the modulus, for DSA the bits returned are of the public exponent

The named parameter idx is of type int. It used as an index for some of the commands. In general it gives the n-th value of a set of values. If not given 0 is used as default.

RETURN VALUE

The return value depends of the type of command used. In general it can be a string, an array of strings or an int. In case of an error, the returned value is NULL.

ERRORS

The given certificate is either missing or <0

The given certificate is not in use

No proper command passed

Unable to run given command

SEE ALSO

cert_open(3nasl)

Doc Manual Nasl Built In Functions Cryptographic DES (`doc/manual/nasl/built-in-functions/cryptographic/DES.md`)

DES(3nasl)

NAME

DES - takes a unnamed paramaeter and return DES hash.

SYNOPSIS

str DES(str);

DES It takes one unnamed argument.

DESCRIPTION

DES is a type of hash function.

RETURN VALUE

DES hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = DES("test");

Doc Manual Nasl Built In Functions Cryptographic HMAC MD2 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_MD2.md`)

HMAC_MD2(3nasl)

NAME

HMAC_MD2 - takes named paramaeter data and key to return HMAC MD2 string.

SYNOPSIS

str HMAC_MD2(key: str, data: str);

HMAC_MD2 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_MD2 is a type of message authentication code involving MD2 hash function and a secret cryptographic key.

RETURN VALUE

HMAC MD2 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_MD2(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD5(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA384(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC MD5 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_MD5.md`)

HMAC_MD5(3nasl)

NAME

HMAC_MD5 - takes named paramaeter data and key to return HMAC MD5 string.

SYNOPSIS

str HMAC_MD5(key: str, data: str);

HMAC_MD5 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_MD5 is a type of message authentication code involving MD5 hash function and a secret cryptographic key.

RETURN VALUE

HMAC MD5 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_MD5(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA384(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC RIPEMD160 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_RIPEMD160.md`)

HMAC_RIPEMD160(3nasl)

NAME

HMAC_RIPEMD160 - takes named paramaeter data and key to return HMAC RIPEMD160 string.

SYNOPSIS

str HMAC_RIPEMD160(key: str, data: str);

HMAC_RIPEMD160 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_RIPEMD160 is a type of message authentication code involving RIPEMD160 hash function and a secret cryptographic key.

RETURN VALUE

HMAC RIPEMD160 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_RIPEMD160(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_MD5(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA384(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC SHA1 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_SHA1.md`)

HMAC_SHA1(3nasl)

NAME

HMAC_SHA1 - takes named paramaeter data and key to return HMAC SHA1 string.

SYNOPSIS

str HMAC_SHA1(key: str, data: str);

HMAC_SHA1 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashin

DESCRIPTION

HMAC_SHA1 is a type of message authentication code involving SHA1 hash function and a secret cryptographic key.

RETURN VALUE

HMAC SHA1 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_SHA1(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_MD5(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA384(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC SHA256 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_SHA256.md`)

HMAC_SHA256(3nasl)

NAME

HMAC_SHA256 - takes named paramaeter data and key to return HMAC SHA256 string.

SYNOPSIS

str HMAC_SHA256(key: str, data: str);

HMAC_SHA256 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_SHA256 is a type of message authentication code involving SHA256 hash function and a secret cryptographic key.

RETURN VALUE

HMAC SHA256 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_SHA256(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_MD5(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA384(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC SHA384 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_SHA384.md`)

HMAC_SHA384(3nasl)

NAME

HMAC_SHA384 - takes named paramaeter data and key to return HMAC SHA384 string.

SYNOPSIS

str HMAC_SHA384(key: str, data: str);

HMAC_SHA384 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_SHA384 is a type of message authentication code involving SHA384 hash function and a secret cryptographic key.

RETURN VALUE

HMAC SHA384 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_SHA384(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_MD5(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic HMAC SHA512 (`doc/manual/nasl/built-in-functions/cryptographic/HMAC_SHA512.md`)

HMAC_SHA512(3nasl)

NAME

HMAC_SHA512 - takes named paramaeter data and key to return HMAC SHA512 string.

SYNOPSIS

str HMAC_SHA512(key: str, data: str);

HMAC_SHA512 It takes two arguments.

  • key - the key to be used for hashing
  • data - to data to be used for hashing

DESCRIPTION

HMAC_SHA512 is a type of message authentication code involving SHA512 hash function and a secret cryptographic key.

RETURN VALUE

HMAC SHA512 string.

ERRORS

Returns NULL when given data is null, given key is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = HMAC_SHA512(key: "my_shared?key", data: "so much wow");

SEE ALSO

HMAC_MD2(3nasl),
HMAC_MD5(3nasl),
HMAC_RIPEMD160(3nasl),
HMAC_SHA1(3nasl),
HMAC_SHA256(3nasl),
HMAC_SHA384(3nasl),

Doc Manual Nasl Built In Functions Cryptographic MD2 (`doc/manual/nasl/built-in-functions/cryptographic/MD2.md`)

MD2(3nasl)

NAME

MD2 - takes a unnamed paramaeter and return MD2 hash.

SYNOPSIS

str MD2(str);

MD2 It takes one unnamed argument.

DESCRIPTION

MD2 is a type of hash function.

RETURN VALUE

MD2 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = MD2("test");

SEE ALSO

MD4(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA1(3nasl),
SHA256(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic MD4 (`doc/manual/nasl/built-in-functions/cryptographic/MD4.md`)

MD4(3nasl)

NAME

MD4 - takes a unnamed paramaeter and return MD4 hash.

SYNOPSIS

str MD4(str);

MD4 It takes one unnamed argument.

DESCRIPTION

MD4 is a type of hash function.

RETURN VALUE

MD4 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = MD4("test");

SEE ALSO

MD2(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA1(3nasl),
SHA256(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic MD5 (`doc/manual/nasl/built-in-functions/cryptographic/MD5.md`)

MD5(3nasl)

NAME

MD5 - takes a unnamed paramaeter and return MD5 hash.

SYNOPSIS

str MD5(str);

MD5 It takes one unnamed argument.

DESCRIPTION

MD5 is a type of hash function.

RETURN VALUE

MD5 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = MD5("test");

SEE ALSO

MD2(3nasl),
MD4(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA1(3nasl),
SHA256(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic NTLMv1 HASH (`doc/manual/nasl/built-in-functions/cryptographic/NTLMv1_HASH.md`)

NTLMv1_HASH(3nasl)

NAME

NTLMv1_HASH - takes two named arguments cryptkey, passhash

SYNOPSIS

str NTLMv1_HASH(cryptkey: str, passhash: str);

NTLMv1_HASH It takes two named arguments cryptkey, passhash.

DESCRIPTION

NTLMv1_HASH generates the NTLMv1_HASH based on the given arguments. To generate the passhash,
nt_owf_gen(3nasl) and lm_owf_gen(3nasl) should be used.

RETURN VALUE

NTLMv1_HASH

ERRORS

Returns NULL when a given parameter is null or the passhash does not have a length of 16.

SEE ALSO

nt_owf_gen(3nasl), lm_owf_gen(3nasl), NTLMv2_HASH(3nasl)

Doc Manual Nasl Built In Functions Cryptographic NTLMv2 HASH (`doc/manual/nasl/built-in-functions/cryptographic/NTLMv2_HASH.md`)

NTLMv2_HASH(3nasl)

NAME

NTLMv2_HASH - takes two named arguments cryptkey, pass_hash

SYNOPSIS

str NTLMv2_HASH(cryptkey: str, password: str, nt_hash: str);

NTLMv2_HASH It takes two named arguments cryptkey, pass_hash.

DESCRIPTION

NTLMv2_HASH generates the NTLMv2_HASH based on the given arguments.

RETURN VALUE

NTLMv2_HASH

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

NTLMv1_HASH(3nasl),

Doc Manual Nasl Built In Functions Cryptographic RIPEMD160 (`doc/manual/nasl/built-in-functions/cryptographic/RIPEMD160.md`)

RIPEMD160(3nasl)

NAME

RIPEMD160 - takes a unnamed paramaeter and return RIPEMD160 hash

SYNOPSIS

str RIPEMD160(str);

RIPEMD160 It takes one unnamed argument.

DESCRIPTION

RIPEMD160 is a type of hash function.

RETURN VALUE

RIPEMD160 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = RIPEMD160("test");

SEE ALSO

MD2(3nasl),
MD4(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
SHA1(3nasl),
SHA256(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic SHA1 (`doc/manual/nasl/built-in-functions/cryptographic/SHA1.md`)

SHA1(3nasl)

NAME

SHA1 - takes a unnamed paramaeter and return SHA1 hash

SYNOPSIS

str SHA1(str);

SHA1 It takes one unnamed argument.

DESCRIPTION

SHA1 is a type of hash function.

RETURN VALUE

SHA1 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = SHA1("test");

SEE ALSO

MD2(3nasl),
MD4(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA256(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic SHA256 (`doc/manual/nasl/built-in-functions/cryptographic/SHA256.md`)

SHA256(3nasl)

NAME

SHA256 - takes a unnamed paramaeter and return SHA256 hash

SYNOPSIS

str SHA256(str);

SHA256 It takes one unnamed argument.

DESCRIPTION

SHA256 is a type of hash function.

RETURN VALUE

SHA256 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = SHA256("test");

SEE ALSO

MD2(3nasl),
MD4(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA1(3nasl),
SHA512(3nasl),

Doc Manual Nasl Built In Functions Cryptographic SHA512 (`doc/manual/nasl/built-in-functions/cryptographic/SHA512.md`)

SHA512(3nasl)

NAME

SHA512 - takes a unnamed paramaeter and return SHA512 hash

SYNOPSIS

str SHA512(str);

SHA512 It takes one unnamed argument.

DESCRIPTION

SHA512 is a type of hash function.

RETURN VALUE

SHA512 hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = SHA512("test");

SEE ALSO

MD2(3nasl),
MD4(3nasl),
MD5(3nasl),
NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
RIPEMD160(3nasl),
SHA1(3nasl),
SHA256(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Cbc Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_cbc_encrypt.md`)

aes128_cbc_encrypt(3nasl)

NAME

aes128_cbc_encrypt - encrypts given data with AES 128 CBC mode.

SYNOPSIS

str aes128_cbc_encrypt(key:str, iv: str, data: str);

aes128_cbc_encrypt encrypts given data with AES 128 CBC mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in CBC mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Ccm Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_ccm_decrypt.md`)

aes128_ccm_decrypt(3nasl)

NAME

aes128_ccm_decrypt - decrypts given encrypted data with AES 128 CCM mode.

SYNOPSIS

str aes128_ccm_decrypt(key:str, iv: str, data: str, len: int);

aes128_ccm_decrypt decrypts given data with AES 128 CCM mode.

DESCRIPTION

decrypt the given data using the AES 128 bit algorithm in CCM mode.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Ccm Decrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes128_ccm_decrypt_auth.md`)

aes128_ccm_decrypt_auth(3nasl)

NAME

aes128_ccm_decrypt_auth - decrypts given data including a authentication token with AES 128 CCM mode.

SYNOPSIS

str aes128_ccm_decrypt_auth(key:str, iv: str, data: str, aad: str, len: int);

aes128_ccm_decrypt_auth decrypts given data including a authentication token with AES 128 CCM mode.

DESCRIPTION

decrypt the given data using the AES 128 bit algorithm in CCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Ccm Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_ccm_encrypt.md`)

aes128_ccm_encrypt(3nasl)

NAME

aes128_ccm_encrypt - encrypts given data with AES 128 CCM mode.

SYNOPSIS

str aes128_ccm_encrypt(key:str, iv: str, data: str);

aes128_ccm_encrypt encrypts given data with AES 128 CCM mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in CCM mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Ccm Encrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes128_ccm_encrypt_auth.md`)

aes128_ccm_encrypt_auth(3nasl)

NAME

aes128_ccm_encrypt_auth - encrypts given data including a authentication token with AES 128 CCM mode.

SYNOPSIS

str aes128_ccm_encrypt_auth(key:str, iv: str, data: str, aad: str);

aes128_ccm_encrypt_auth encrypts given data including a authentication token with AES 128 CCM mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in CCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Ctr Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_ctr_encrypt.md`)

aes128_ctr_encrypt(3nasl)

NAME

aes128_ctr_encrypt - encrypts given data with AES 128 CTR mode.

SYNOPSIS

str aes128_ctr_encrypt(key:str, iv: str, data: str);

aes128_ctr_encrypt encrypts given data with AES 128 CTR mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in CTR mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Gcm Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_gcm_decrypt.md`)

aes128_gcm_decrypt(3nasl)

NAME

aes128_gcm_decrypt - decrypts given encrypted data with AES 128 GCM mode.

SYNOPSIS

str aes128_gcm_decrypt(key:str, iv: str, data: str, len: int);

aes128_gcm_decrypt decrypts given data with AES 128 GCM mode.

DESCRIPTION

decrypt the given data using the AES 128 bit algorithm in GCM mode.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Gcm Decrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes128_gcm_decrypt_auth.md`)

aes128_gcm_decrypt_auth(3nasl)

NAME

aes128_gcm_decrypt_auth - decrypts given data including a authentication token with AES 128 GCM mode.

SYNOPSIS

str aes128_gcm_decrypt_auth(key:str, iv: str, data: str, aad: str, len: int);

aes128_gcm_decrypt_auth decrypts given data including a authentication token with AES 128 GCM mode.

DESCRIPTION

decrypt the given data using the AES 128 bit algorithm in GCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Gcm Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes128_gcm_encrypt.md`)

aes128_gcm_encrypt(3nasl)

NAME

aes128_gcm_encrypt - encrypts given data with AES 128 GCM mode.

SYNOPSIS

str aes128_gcm_encrypt(key:str, iv: str, data: str);

aes128_gcm_encrypt encrypts given data with AES 128 GCM mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in GCM mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),
aes_mac_cbc(3nasl),
aes_mac_gcm(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes128 Gcm Encrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes128_gcm_encrypt_auth.md`)

aes128_gcm_encrypt_auth(3nasl)

NAME

aes128_gcm_encrypt_auth - encrypts given data including a authentication token with AES 128 GCM mode.

SYNOPSIS

str aes128_gcm_encrypt_auth(key:str, iv: str, data: str, aad: str);

aes128_gcm_encrypt_auth encrypts given data including a authentication token with AES 128 GCM mode.

DESCRIPTION

Encrypt the given data using the AES 128 bit algorithm in GCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Cbc Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_cbc_encrypt.md`)

aes256_cbc_encrypt(3nasl)

NAME

aes256_cbc_encrypt - encrypts given data with AES 256 CBC mode.

SYNOPSIS

str aes256_cbc_encrypt(key:str, iv: str, data: str);

aes256_cbc_encrypt encrypts given data with AES 256 CBC mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in CBC mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Ccm Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_ccm_decrypt.md`)

aes256_ccm_decrypt(3nasl)

NAME

aes256_ccm_decrypt - decrypts given encrypted data with AES 256 CCM mode.

SYNOPSIS

str aes256_ccm_decrypt(key:str, iv: str, data: str, len: int);

aes256_ccm_decrypt decrypts given data with AES 256 CCM mode.

DESCRIPTION

decrypt the given data using the AES 256 bit algorithm in CCM mode.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Ccm Decrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes256_ccm_decrypt_auth.md`)

aes256_ccm_decrypt_auth(3nasl)

NAME

aes256_ccm_decrypt_auth - decrypts given data including a authentication token with AES 256 CCM mode.

SYNOPSIS

str aes256_ccm_decrypt_auth(key:str, iv: str, data: str, aad: str, len: int);

aes256_ccm_decrypt_auth decrypts given data including a authentication token with AES 256 CCM mode.

DESCRIPTION

decrypt the given data using the AES 256 bit algorithm in CCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Ccm Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_ccm_encrypt.md`)

aes256_ccm_encrypt(3nasl)

NAME

aes256_ccm_encrypt - encrypts given data with AES 256 CCM mode.

SYNOPSIS

str aes256_ccm_encrypt(key:str, iv: str, data: str);

aes256_ccm_encrypt encrypts given data with AES 256 CCM mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in CCM mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Ccm Encrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes256_ccm_encrypt_auth.md`)

aes256_ccm_encrypt_auth(3nasl)

NAME

aes256_ccm_encrypt_auth - encrypts given data including a authentication token with AES 256 CCM mode.

SYNOPSIS

str aes256_ccm_encrypt_auth(key:str, iv: str, data: str, aad: str);

aes256_ccm_encrypt_auth encrypts given data including a authentication token with AES 256 CCM mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in CCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Ctr Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_ctr_encrypt.md`)

aes256_ctr_encrypt(3nasl)

NAME

aes256_ctr_encrypt - encrypts given data with AES 256 CTR mode.

SYNOPSIS

str aes256_ctr_encrypt(key:str, iv: str, data: str);

aes256_ctr_encrypt encrypts given data with AES 256 CTR mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in CTR mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Gcm Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_gcm_decrypt.md`)

aes256_gcm_decrypt(3nasl)

NAME

aes256_gcm_decrypt - decrypts given encrypted data with AES 256 GCM mode.

SYNOPSIS

str aes256_gcm_decrypt(key:str, iv: str, data: str, len: int);

aes256_gcm_decrypt decrypts given data with AES 256 GCM mode.

DESCRIPTION

decrypt the given data using the AES 256 bit algorithm in GCM mode.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Gcm Decrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes256_gcm_decrypt_auth.md`)

aes256_gcm_decrypt_auth(3nasl)

NAME

aes256_gcm_decrypt_auth - decrypts given data including a authentication token with AES 256 GCM mode.

SYNOPSIS

str aes256_gcm_decrypt_auth(key:str, iv: str, data: str, aad: str, len: int);

aes256_gcm_decrypt_auth decrypts given data including a authentication token with AES 256 GCM mode.

DESCRIPTION

decrypt the given data using the AES 256 bit algorithm in GCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the decrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_encrypt(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Gcm Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/aes256_gcm_encrypt.md`)

aes256_gcm_encrypt(3nasl)

NAME

aes256_gcm_encrypt - encrypts given data with AES 256 GCM mode.

SYNOPSIS

str aes256_gcm_encrypt(key:str, iv: str, data: str);

aes256_gcm_encrypt encrypts given data with AES 256 GCM mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in GCM mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt_auth(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes256 Gcm Encrypt Auth (`doc/manual/nasl/built-in-functions/cryptographic/aes256_gcm_encrypt_auth.md`)

aes256_gcm_encrypt_auth(3nasl)

NAME

aes256_gcm_encrypt_auth - encrypts given data including a authentication token with AES 256 GCM mode.

SYNOPSIS

str aes256_gcm_encrypt_auth(key:str, iv: str, data: str, aad: str);

aes256_gcm_encrypt_auth encrypts given data including a authentication token with AES 256 GCM mode.

DESCRIPTION

Encrypt the given data using the AES 256 bit algorithm in GCM mode including an authentication token given via aad.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes128_cbc_encrypt(3nasl),
aes128_ccm_decrypt(3nasl),
aes128_ccm_decrypt_auth(3nasl),
aes128_ccm_encrypt(3nasl),
aes128_ccm_encrypt_auth(3nasl),
aes128_ctr_encrypt(3nasl),
aes128_gcm_decrypt(3nasl),
aes128_gcm_decrypt_auth(3nasl),
aes128_gcm_encrypt(3nasl),
aes128_gcm_encrypt_auth(3nasl),
aes256_cbc_encrypt(3nasl),
aes256_ccm_decrypt(3nasl),
aes256_ccm_decrypt_auth(3nasl),
aes256_ccm_encrypt(3nasl),
aes256_ccm_encrypt_auth(3nasl),
aes256_ctr_encrypt(3nasl),
aes256_gcm_decrypt(3nasl),
aes256_gcm_decrypt_auth(3nasl),
aes256_gcm_encrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes Mac Cbc (`doc/manual/nasl/built-in-functions/cryptographic/aes_mac_cbc.md`)

aes_mac_cbc(3nasl)

NAME

aes_mac_cbc - takes two named arguments key, data

SYNOPSIS

str aes_mac_cbc(key: str, data: str);

aes_mac_cbc It takes four named arguments key, data.

DESCRIPTION

aes_mac_cbc encrypts given data with given key by using AES in CBC mode.
The according aes algorithm is dependent on the key size (if the key is 128 bit than AES128 is used, 256 and 512 are supported.)

RETURN VALUE

Encrypted data

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes_mac_gcm(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Aes Mac Gcm (`doc/manual/nasl/built-in-functions/cryptographic/aes_mac_gcm.md`)

aes_mac_gcm(3nasl)

NAME

aes_mac_gcm - takes two named arguments key, data

SYNOPSIS

str aes_mac_gcm(key: str, data: str, iv: str);

aes_mac_gcm It takes three named arguments key, data, iv.

DESCRIPTION

aes_mac_gcm encrypts given data with given key by using AES in GCM mode.
The according aes algorithm is dependent on the key size (if the key is 128 bit than AES128 is used, 256 and 512 are supported.)

RETURN VALUE

Encrypted data

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

aes_mac_gcm(3nasl)

Doc Manual Nasl Built In Functions Cryptographic Bf Cbc Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/bf_cbc_decrypt.md`)

bf_cbc_decrypt(3nasl)

NAME

bf_cbc_decrypt - decrypts given data with blowfish CBC mode.

SYNOPSIS

str bf_cbc_decrypt(key:str, iv: str, data: str);

bf_cbc_decrypt decrypts given data with blowfish CBC mode.

DESCRIPTION

decrypt the given data using the blowfish algorithm in CBC mode.

The key must be 16 bytes long.
The iv must be at least 8 bytes long.
Data must be a multiple of 8 bytes long.

RETURN VALUE

The return value is an array a with a[0] being the decrypted data and a[1] the new initialization vector to use for the next part of the data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

bf_cbc_encrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Bf Cbc Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/bf_cbc_encrypt.md`)

bf_cbc_encrypt(3nasl)

NAME

bf_cbc_encrypt - encrypts given data with blowfish CBC mode.

SYNOPSIS

str bf_cbc_encrypt(key:str, iv: str, data: str);

bf_cbc_encrypt encrypts given data with blowfish CBC mode.

DESCRIPTION

Encrypt the given data using the blowfish algorithm in CBC mode.

The key must be 16 bytes long.
The iv must be at least 8 bytes long.
Data must be a multiple of 8 bytes long.

RETURN VALUE

The return value is an array a with a[0] being the encrypted data and a[1] the new initialization vector to use for the next part of the data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

bf_cbc_decrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Bn Cmp (`doc/manual/nasl/built-in-functions/cryptographic/bn_cmp.md`)

bn_cmp(3nasl)

NAME

bn_cmp - compares two big numbers

SYNOPSIS

str bn_cmp(key1: str, key2: str);

bn_cmp It takes two named arguments

DESCRIPTION

Compares two big numbers given as Bytes interpreted in big endian.

RETURN VALUE

0 when key and key2 are equal, -1 when key1 < key2 and 1 when key1 > key2.

SEE ALSO

bn_random(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Bn Random (`doc/manual/nasl/built-in-functions/cryptographic/bn_random.md`)

bn_random(3nasl)

NAME

bn_random - generates a random big number

SYNOPSIS

str bn_random(need: int);

bn_random takes one named argument

DESCRIPTION

This function generates a big number (bn) with the given amount of bits.
As this function generates the number as bytes, it actually takes the number of bits, divides them by 8
and rounds them up. It does not only generate the desired number of bits for the last byte, but a whole
random byte.

A big number is an integer, that is probably to big for any primitive data type. In case of the
c implementation the mpi (multi-precision integer) type of libgcrypt was used.

RETURN VALUE

A random big number as bytes

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

bn_cmp(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Close Stream Cipher (`doc/manual/nasl/built-in-functions/cryptographic/close_stream_cipher.md`)

close_stream_cipher(3nasl)

NAME

close_stream_cipher - closes a stream cipher.

SYNOPSIS

str close_stream_cipher(hd: int);

close_stream_cipher closes a stream cipher.

DESCRIPTION

Closes a stream cipher.

RETURN VALUE

0 when the hd is closed.

ERRORS

Returns NULL when the handler given by the hd index was not found.

SEE ALSO

rc4_encrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Des Ede Cbc Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/des_ede_cbc_encrypt.md`)

des_ede_cbc_encrypt(3nasl)

NAME

des_ede_cbc_encrypt - encrypts given data with DES EDE CBC mode.

SYNOPSIS

str des_ede_cbc_encrypt(key:str, data: str, iv: str);

des_ede_cbc_encrypt encrypts given data with triple DES EDE CBC mode.

DESCRIPTION

Encrypt the given data using the triple DES EDE algorithm in CBC mode.

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when a given parameter is null.

Doc Manual Nasl Built In Functions Cryptographic Dh Compute Key (`doc/manual/nasl/built-in-functions/cryptographic/dh_compute_key.md`)

dh_compute_key(3nasl)

NAME

dh_compute_key - computes the shared secret with the given shared parameter p and g, the servers public key and the clients private and public key.

SYNOPSIS

str dh_compute_key(p: str, g: str, dh_server_pub: str, pub_key: str, priv_key:str);

dh_compute_key computes the shared secret with the given shared parameter p and g, the servers public key and the clients private and public key.

DESCRIPTION

Computes the shared secret with:

  • shared parameter p,
  • shared parameter g,
  • the servers public key dh_server_pub,
  • the clients public key pub_key
  • the clients private key priv_key

RETURN VALUE

Shared secret to be used as an MPI.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

dh_generate_key(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Dh Generate Key (`doc/manual/nasl/built-in-functions/cryptographic/dh_generate_key.md`)

dh_generate_key(3nasl)

NAME

dh_generate_key - takes three named arguments p, g and priv to generate the public key.

SYNOPSIS

str dh_generate_key(p: str, g: str, priv: str);

dh_generate_key It takes three named arguments p, g and priv to generate the public key.

DESCRIPTION

dh_generate_key generates the public key based on p, g and the private key.

RETURN VALUE

public key

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

dh_compute_key(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Dsa Do Sign (`doc/manual/nasl/built-in-functions/cryptographic/dsa_do_sign.md`)

dsa_do_sign(3nasl)

NAME

dsa_do_sign - computes DSA signature.

SYNOPSIS

str dsa_do_sign(p: str, g: str, q: str, pub: str, priv: str, data: str);

dsa_do_sign computes DSA signature.

DESCRIPTION

Computes the DSA signature of the hash in data using the private DSA key given by p, g, q, pub and priv.

RETURN VALUE

The return value is a 40 byte string encoding the two MPIs r and s of the DSA signature. The first 20 bytes are the value of r and the last 20 bytes are the value of s.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

dsa_do_verify(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Dsa Do Verify (`doc/manual/nasl/built-in-functions/cryptographic/dsa_do_verify.md`)

dsa_do_verify(3nasl)

NAME

dsa_do_verify - verifies that the DSA signature matches the hash based on the public DSA key. Returns 1 if the signature is valid otherwise 0.

SYNOPSIS

str dsa_do_verify(p: str, g: str, q: str, pub: str, r: str, s: str, data: str);

dsa_do_verify verifies that the DSA signature matches the hash based on the public DSA key. Returns 1 if the signature is valid otherwise 0.

DESCRIPTION

Verifies that the DSA signature given by r and s matches the hash given in data based on the public DSA key by p, g q and pub.

RETURN VALUE

Returns 1 if the signature is valid otherwise 0.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

dsa_do_sign(3nasl)

Doc Manual Nasl Built In Functions Cryptographic Get Signature (`doc/manual/nasl/built-in-functions/cryptographic/get_signature.md`)

get_signature(3nasl)

NAME

get_signature - takes four named arguments key, buf, buflen, seq_number

SYNOPSIS

str get_signature(key: str, buf: str, buflen: int, seq_number: int);

get_signature It takes four named arguments key, buf, buflen, seq_number.

DESCRIPTION

get_signature gets the ntlmssp signature based on the given arguments.

RETURN VALUE

get_signature

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
ntlm2_response(3nasl),
ntlm_response(3nasl),
ntlmv2_response(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Get Smb2 Signature (`doc/manual/nasl/built-in-functions/cryptographic/get_smb2_signature.md`)

get_smb2_signature(3nasl)

NAME

get_smb2_signature - takes two named arguments key, buf

SYNOPSIS

str get_smb2_signature(key: str, buf: str);

get_smb2_signature It takes four named arguments key, buf.

DESCRIPTION

get_smb2_signature gets the smb2 signature based on the given arguments.

RETURN VALUE

get_smb2_signature

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

smb3kdf(3nasl),
smb_cmac_aes_signature(3nasl),
smb_gmac_aes_signature(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Insert Hexzeros (`doc/manual/nasl/built-in-functions/cryptographic/insert_hexzeros.md`)

insert_hexzeros(3nasl)

NAME

insert_hexzeros - appends a empty byte to each character in a string

SYNOPSIS

str insert_hexzeros(in: string);

insert_hexzeros takes 1 named argument.

DESCRIPTION

This function takes a string and appends an empty byte to each character. Its argument is:

  • in: the string to modify

RETURN VALUE

The modified string.

Doc Manual Nasl Built In Functions Cryptographic Key Exchange (`doc/manual/nasl/built-in-functions/cryptographic/key_exchange.md`)

key_exchange(3nasl)

NAME

key_exchange - takes three named arguments cryptkey, session_key, nt_hash

SYNOPSIS

str key_exchange(cryptkey: str, session_key: str, nt_hash: str);

key_exchange It takes three named arguments cryptkey, session_key, nt_hash.

DESCRIPTION

key_exchange uses the given cryptkey, session key as well as password hash to generate an authentication key.

RETURN VALUE

authentication key.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
nt_owf_gen(3nasl),
ntlm2_response(3nasl),
ntlm_response(3nasl),
ntlmv2_response(3nasl),
ntv2_owf_gen(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Lm Owf Gen (`doc/manual/nasl/built-in-functions/cryptographic/lm_owf_gen.md`)

lm_owf_gen(3nasl)

NAME

lm_owf_gen - takes an unnamed parameter and returns LM one way hash.

SYNOPSIS

str lm_owf_gen(str);

lm_owf_gen It takes one unnamed argument.

DESCRIPTION

lm_owf_gen is a type of hash function. It produces the LM Hash (part of NTLM) for the
NTLMv1_HASH(3nasl) function. This is the counterpart to the
nt_owf_gen(3nasl) function.

LM - Lan Manager
OWF - one way function
gen - generate

RETURN VALUE

LM Hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = lm_owf_gen("test");

SEE ALSO

NTLMv1_HASH(3nasl),
nt_owf_gen(3nasl),
ntv2_owf_gen(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Nt Owf Gen (`doc/manual/nasl/built-in-functions/cryptographic/nt_owf_gen.md`)

nt_owf_gen(3nasl)

NAME

nt_owf_gen - takes an unnamed parameter and returns NT one way hash.

SYNOPSIS

str nt_owf_gen(str);

nt_owf_gen It takes one unnamed argument.

DESCRIPTION

nt_owf_gen is a type of hash function. It produces the NT Hash (part of NTLM) for the
NTLMv1_HASH(3nasl) function. This is the counterpart to the
lm_owf_gen(3nasl) function.

NT - New Technology
OWF - one way function
gen - generate

RETURN VALUE

NT hash

ERRORS

Returns NULL when given data is null or when the algorithm is not supported by the installed gcrypt library.

EXAMPLES

cpp
hash = nt_owf_gen("test");

SEE ALSO

NTLMv1_HASH(3nasl)
lm_owf_gen(3nasl),
ntv2_owf_gen(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Ntlm2 Response (`doc/manual/nasl/built-in-functions/cryptographic/ntlm2_response.md`)

ntlm2_response(3nasl)

NAME

ntlm2_response - takes three named arguments cryptkey, password, nt_hash

SYNOPSIS

str ntlm2_response(cryptkey: str, password: str, nt_hash: str);

ntlm2_response It takes three named arguments cryptkey, password, nt_hash to generate ntlm2 response.

The nt_hash is the nt_owf_gen response of the password given in password.

DESCRIPTION

ntlm2_response generates the ntlm2_response based on the given arguments.

RETURN VALUE

ntlm2_response

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

ntlm_response(3nasl),
ntlmv2_response(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Ntlm Response (`doc/manual/nasl/built-in-functions/cryptographic/ntlm_response.md`)

ntlm_response(3nasl)

NAME

ntlm_response - takes four named arguments cryptkey, password, nt_hash, neg_flags

SYNOPSIS

str ntlm_response(cryptkey: str, password: str, nt_hash: str, neg_flags: int);

ntlm_response It takes four named arguments cryptkey, password, nt_hash, neg_flags to generate ntlm response.

The nt_hash is the nt_owf_gen response of the password given in password.
The neg_flags must be a positive number and is used to determine if it is using a MD4 hash basis when set to 0x00000080 or a 128 bit unchanged basis when set differently.

DESCRIPTION

ntlm_response generates the ntlm_response based on the given arguments.

RETURN VALUE

ntlm_response

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

ntlm2_response(3nasl),
ntlmv2_response(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Ntlmv2 Response (`doc/manual/nasl/built-in-functions/cryptographic/ntlmv2_response.md`)

ntlmv2_response(3nasl)

NAME

ntlmv2_response - takes six named arguments cryptkey, user, domain, ntlmv2_hash, address_list, address_list_len to generate a ntlmv2 response.

SYNOPSIS

str ntlmv2_response(cryptkey: str, user: str, domain: str, ntlmv2_hash: str, address_list: str, address_list_len: int);

ntlmv2_response It takes six named arguments cryptkey, user, domain, ntlmv2_hash, address_list, address_list_len to generate a ntlmv2 response.

The ntlmv2_hash is usually the output of ntv2_owf_gen.

DESCRIPTION

ntlmv2_response generates the ntlmv2_response based on the given arguments to calculate the session_key.

RETURN VALUE

ntlmv2_response

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

NTLMv1_HASH(3nasl),
NTLMv2_HASH(3nasl),
ntlm2_response(3nasl),
ntlm_response(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Ntv2 Owf Gen (`doc/manual/nasl/built-in-functions/cryptographic/ntv2_owf_gen.md`)

ntv2_owf_gen(3nasl)

NAME

ntv2_owf_gen - takes fiven named arguments owf, login, domain, length, insert_hexzeros to generate the NTLMv2 of a users's password.

SYNOPSIS

str ntv2_owf_gen(owf: str, login: str, domain: str, length int, insert_hexzeros str);

ntv2_owf_gen It takes fiven named arguments owf, login, domain, length, insert_hexzeros to generate the NTLMv2 of a users's password.

DESCRIPTION

ntv2_owf_gen generates the ntv2_owf_gen based on the given arguments.

RETURN VALUE

ntv2_owf_gen

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

lm_owf_gen(3nasl),
nt_owf_gen(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Open Rc4 Cipher (`doc/manual/nasl/built-in-functions/cryptographic/open_rc4_cipher.md`)

open_rc4_cipher(3nasl)

NAME

open_rc4_cipher - opens an rc4 encryption handler for data stream encryptions.

SYNOPSIS

str open_rc4_cipher(key:str, iv: str);

open_rc4_cipher opens an rc4 encryption handler for data stream encryptions.

DESCRIPTION

Open RC4 cipher to encrypt a stream of data. The handler can be used to encrypt stream data.

Opened cipher must be closed with (close_stream_cipher)[close_stream_cipher.md] when it is not used anymore.

-iv: the initival vector
-key: the key used for encryption

RETURN VALUE

Returns the id of the encrypted data cipher handler on success.

ERRORS

Returns a negative number on failure.

SEE ALSO

close_stream_cipher(3nasl),
rc4_encrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Pem To Dsa (`doc/manual/nasl/built-in-functions/cryptographic/pem_to_dsa.md`)

pem_to_dsa(3nasl)

NAME

pem_to_dsa - reads the private key in pem format to return the x parameter of the DSA key.

SYNOPSIS

str pem_to_dsa(priv: str, passphrase: str);

pem_to_dsa reads the private key in pem format to return the x parameter of the DSA key.

DESCRIPTION

Reads the private key from the priv which contains a private DSA key in PEM format.

passphrase is the password needed to decrypt the private key.

RETURN VALUE

Returns the parameter x of the DSA key as an MPI.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

pem_to_rsa(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Pem To Rsa (`doc/manual/nasl/built-in-functions/cryptographic/pem_to_rsa.md`)

pem_to_rsa(3nasl)

NAME

pem_to_rsa - reads the private key in pem format to return the d parameter of the RSA key.

SYNOPSIS

str pem_to_rsa(priv: str, passphrase: str);

pem_to_rsa reads the private key in pem format to return the d parameter of the RSA key.

DESCRIPTION

Reads the private key from the priv which contains a private RSA key in PEM format.

passphrase is the password needed to decrypt the private key.

RETURN VALUE

Returns the parameter ”d” of the RSA key as an MPI.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

pem_to_dsa(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Prf Sha256 (`doc/manual/nasl/built-in-functions/cryptographic/prf_sha256.md`)

prf_sha256(3nasl)

NAME

prf_sha256 - takes four named arguments secret, seed, label, outlen

SYNOPSIS

str prf_sha256(secret: str, seed: str, label: str, outlen: int);

prf_sha256 It takes four named arguments secret, seed, label, outlen.

DESCRIPTION

prf_sha256 is pseudo random function based on rfc-2246§5.

It uses given seed and label as a basis for the pseudo random generator while the secret is the basis of the hash limited by the given outlen parameter.

The outlen is the length of the returned value in bytes.

RETURN VALUE

prf_sha256 hash

ERRORS

Returns NULL when a given parameter is null.

EXAMPLES

cpp
hash = prf_sha256(secret: "my_secret", seed: "a", label: "very secure", outlenL 48);

SEE ALSO

prf_sha384(3nasl),
tls1_prf(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Prf Sha384 (`doc/manual/nasl/built-in-functions/cryptographic/prf_sha384.md`)

prf_sha384(3nasl)

NAME

prf_sha384 - takes four named arguments secret, seed, label, outlen

SYNOPSIS

str prf_sha384(secret: str, seed: str, label: str, outlen: int);

prf_sha384 It takes four named arguments secret, seed, label, outlen.

DESCRIPTION

prf_sha384 is pseudo random function based on rfc-2246§5.

It uses given seed and label as a basis for the pseudo random generator while the secret is the basis of the hash limited by the given outlen parameter.

The outlen is the length of the returned value in bytes.

RETURN VALUE

prf_sha384 hash

ERRORS

Returns NULL when a given parameter is null.

EXAMPLES

cpp
hash = prf_sha384(secret: "my_secret", seed: "a", label: "very secure", outlenL 48);

SEE ALSO

prf_sha256(3nasl),
tls1_prf(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Rc4 Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/rc4_encrypt.md`)

rc4_encrypt(3nasl)

NAME

rc4_encrypt - encrypts given data with rc4.

SYNOPSIS

str rc4_encrypt(data: str, hd: int, iv: str, key: str);

rc4_encrypt encrypts given data with blowfish CBC mode.

DESCRIPTION

Encrypt data with a RC4 cipher.
If a previously opened (RC4 handler)[open_rc4_cipher.md] exist the hd parameter should be set it will use the handler for encryption.

If there is no open handler than the key and iv parameter must be set.

-data: string Data to decrypt
-hd: the handler index. (mandatory if not key and iv is given)
-iv: string Initialization vector (mandatory if no handler is given).
-key: string key (mandatory if no handler is given).

RETURN VALUE

The return value is the encrypted data.

ERRORS

Returns NULL when there is no handler or no key and iv is provided.

SEE ALSO

close_stream_cipher(3nasl),
open_rc4_cipher(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Rsa Private Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/rsa_private_decrypt.md`)

rsa_private_decrypt(3nasl)

NAME

rsa_private_decrypt - decrypts provided data with the public RSA key given by e, n and d. Returns the decrypted data.

SYNOPSIS

str rsa_private_decrypt(pad: bool, data: str, e: str, n: str, d: str);

rsa_private_decrypt decrypts provided data with the public RSA key given by e, n and d. Returns the decrypted data.

DESCRIPTION

Encrypts provided data with the private RSA key given by e and n. Returns the encrypted data.

  • pad: when true it is using padding\
  • data: the data to encrypt
  • e: part of the private rsa key
  • n: part of the private rsa key
  • d: part of the private rsa key

RETURN VALUE

Decrypted data

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

rsa_public_decrypt(3nasl),
rsa_public_encrypt(3nasl),
rsa_sign(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Rsa Public Decrypt (`doc/manual/nasl/built-in-functions/cryptographic/rsa_public_decrypt.md`)

rsa_public_decrypt(3nasl)

NAME

rsa_public_decrypt - decrypts provided data with the public RSA key given by e and d. Returns the decrypted data.

SYNOPSIS

str rsa_public_decrypt(sig: str, e: str, n: str);

rsa_public_decrypt decrypts provided data with the public RSA key given by e and n. Returns the decrypted data.

DESCRIPTION

Decrypts provided sig with the public RSA key given by e and n. Returns the decrypted data.

  • sign: the data to encrypt
  • e: part of the public rsa key
  • n: part of the public rsa key

RETURN VALUE

Decrypted data

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

rsa_private_decrypt(3nasl),
rsa_public_encrypt(3nasl),
rsa_sign(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Rsa Public Encrypt (`doc/manual/nasl/built-in-functions/cryptographic/rsa_public_encrypt.md`)

rsa_public_encrypt(3nasl)

NAME

rsa_public_encrypt - encrypts provided data with the public RSA key given by e and n. Returns the encrypted data.

SYNOPSIS

str rsa_public_encrypt(pad: bool, data: str, e: str, n: str);

rsa_public_encrypt encrypts provided data with the public RSA key given by e and n. Returns the encrypted data.

DESCRIPTION

Encrypts provided data with the public RSA key given by e and n. Returns the encrypted data.

  • pad: when true it is using padding\
  • data: the data to encrypt
  • e: part of the public rsa key
  • n: part of the public rsa key

RETURN VALUE

Encrypted data

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

rsa_private_decrypt(3nasl),
rsa_public_decrypt(3nasl),
rsa_sign(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Rsa Sign (`doc/manual/nasl/built-in-functions/cryptographic/rsa_sign.md`)

rsa_sign(3nasl)

NAME

rsa_sign - signs data with the given private RSA key.

SYNOPSIS

str rsa_sign(data: str, priv: str, passphrase: str);

rsa_sign signs data with the given private RSA key.

DESCRIPTION

Signs the data with the private RSA key priv given in PEM format.

The passphrase is the password needed to decrypt the private key.

RETURN VALUE

Returns the signed data.

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

rsa_private_decrypt(3nasl),
rsa_public_decrypt(3nasl),
rsa_public_encrypt(3nasl),

Doc Manual Nasl Built In Functions Cryptographic Smb3kdf (`doc/manual/nasl/built-in-functions/cryptographic/smb3kdf.md`)

smb3kdf(3nasl)

NAME

smb3kdf - is a key derivation function for SMB3

SYNOPSIS

str smb3kdf(key: str, label: str, ctx: str, lvalue: int);

smb3kdf It takes six named arguments cryptkey, user, domain, ntlmv2_hash, address_list, address_list_len to generate a ntlmv2 response.

The ntlmv2_hash is usually the output of ntv2_owf_gen.

DESCRIPTION

smb3kdf is a key derivation function for SMB3 based on SP800-108 §5.1.

RETURN VALUE

The deviated key.

ERRORS

Returns NULL when a given parameter is null.

Doc Manual Nasl Built In Functions Cryptographic Smb Cmac Aes Signature (`doc/manual/nasl/built-in-functions/cryptographic/smb_cmac_aes_signature.md`)

smb_cmac_aes_signature(3nasl)

NAME

smb_cmac_aes_signature - takes two named arguments key, buf

SYNOPSIS

str smb_cmac_aes_signature(key: str, buf: str);

smb_cmac_aes_signature It takes four named arguments key, buf.

DESCRIPTION

smb_cmac_aes_signature gets the cmac aes signature based on the given arguments.
This function is basically the same as aes_mac_cbc(3nasl)

RETURN VALUE

smb_cmac_aes_signature

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

smb_gmac_aes_signature(3nasl), aes_mac_cbc(3nasl)

Doc Manual Nasl Built In Functions Cryptographic Smb Gmac Aes Signature (`doc/manual/nasl/built-in-functions/cryptographic/smb_gmac_aes_signature.md`)

smb_gmac_aes_signature(3nasl)

NAME

smb_gmac_aes_signature - takes two named arguments key, buf, iv

SYNOPSIS

str smb_gmac_aes_signature(key: str, buf: str, iv: str);

smb_gmac_aes_signature It takes four named arguments key, buf. iv

DESCRIPTION

smb_gmac_aes_signature gets the gmac_aes signature based on the given arguments.
This function is basically the same as aes_mac_gcm(3nasl)

RETURN VALUE

smb_gmac_aes_signature

ERRORS

Returns NULL when a given parameter is null.

SEE ALSO

smb_cmac_aes_signature(3nasl), aes_mac_gcm(3nasl)

Doc Manual Nasl Built In Functions Cryptographic Tls1 Prf (`doc/manual/nasl/built-in-functions/cryptographic/tls1_prf.md`)

tls1_prf(3nasl)

NAME

DEPRECATED

tls1_prf - takes four named arguments secret, seed, label, outlen. This function is deprecated and will not longer be supported!

SYNOPSIS

str tls1_prf(secret: str, seed: str, label: str, outlen: int);

tls1_prf It takes four named arguments secret, seed, label, outlen.

DESCRIPTION

tls1_prf is pseudo random function based on rfc-4346§5.

It uses given seed and label as a basis for the pseudo random generator while the secret is the basis of the hash limited by the given outlen parameter.

DEPRECATED

This function is deprecated and prf_sha256(3nasl) or prf_sha384(3nasl) should be used instead.

RETURN VALUE

tls1_prf hash

ERRORS

Returns NULL when a given parameter is null.

EXAMPLES

cpp
hash = tls1_prf(secret: "my_secret", seed: "a", label: "very secure", outlenL 48);

SEE ALSO

prf_sha256(3nasl),
prf_sha384(3nasl),

Doc Manual Nasl Built In Functions Description Functions Script Add Preference (`doc/manual/nasl/built-in-functions/description-functions/script_add_preference.md`)

script_add_preference(3nasl)

NAME

script_add_preference - adds an option to the plugin.

SYNOPSIS

any script_add_preference(name: string, type: string, value: string, id: int);

script_add_preference It takes four named arguments.

  • name is the option name. As it is displayed “as is” in the GUI, it usually ends with “:”. Despite since GVM 11 (openvas-scanner-7) the VT preferences are ID based, it is not possible to drop the name, since it is use in the GUI, as already mentioned. Also, until versions older than GVM 11 reach the end of life, the preference name can not be modified, since in those older version the preferences are still name-based.

  • type is the option type. It may be: checkbox, entry, password, radio

  • value is the default value (“yes” or “no” for "checkbox", a text string for “entry” or “password”) except for “radio”, where it is the list of options (separate the items with “;”). e.g.
    script_add_preference(name:"Reverse traversal", type:"radio", value:"none;Basic;Long URL", id:1);

  • id is the id for that preference.

    • Should not be modified once existing!
    • The scanner detects if the id is repeated. If a preference does not have an ID and the following line adds a preferences with the ID = 1, the scanner will log a messages. This is because an ID will be assigned automatically for the first preference without ID (assign id = 1). The second preferences tries to add a new entry with the id 1, which is already in use, but it is not possible. Therefore is very important to preserve the order of the preferences once they have been added without an id.
    • Do not use ID 0. The scanner detects if the id 0 is being used, which is invalid because id 0 is reserved for the timeout preference.
    • The scanner detects if an ID has a non-integer value. An error messages is shown in the log
    • The preference id should always stay the same. One of the reasons for introducing the id was ensuring that configs will refer to the correct preference even if the preference name is changed (e.g. to fix a typo).
    • Removing preferences, and especially reusing the ids should be avoided because they are not removed from scan configs, which could result in an inconsistent state if the id is reused for something different.
    • For preference without ID, the assigned ID is the position number in the preference list. If the order is changed, it is as removing the preference and adding a new one reusing the ID, which could result in an inconsistent state.

DESCRIPTION

This function adds plugin preference to the plugin.

RETURN VALUE

KB items as a list of key-value pairs or None if array size is 0

ERRORS

  • Invalid id or not allowed id value. ID must be greater than 0.
  • Argument error in the call to script_add_preference. No name nor type neither value.
  • Preference already exists.

EXAMPLES

1:

cpp
script_add_preference(name:"Service scan", type:"checkbox", value:"no", id:2);

SEE ALSO

script_category(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Category (`doc/manual/nasl/built-in-functions/description-functions/script_category.md`)

script_category(3nasl)

NAME

script_category - sets the plugin's category.

SYNOPSIS

any script_category(string);

script category It takes one unnamed value.

DESCRIPTION

Sets the plugin's category. The valid categories are the following:

  • ACT_INIT
  • ACT_SCANNER
  • ACT_SETTINGS
  • ACT_GATHER_INFO
  • ACT_ATTACK
  • ACT_MIXED_ATTACK
  • ACT_DESTRUCTIVE_ATTACK
  • ACT_DENIAL
  • ACT_KILL_HOST
  • ACT_FLOOD
  • ACT_END

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_category(<category>);

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

script_copyright - Deprecated. Kept for backward compatibility, but currently does nothing.

Doc Manual Nasl Built In Functions Description Functions Script Cve Id (`doc/manual/nasl/built-in-functions/description-functions/script_cve_id.md`)

script_cve_id(3nasl)

NAME

script_cve_id - sets the CVE IDs of the flaws tested by the script.

SYNOPSIS

any script_cve_id(string, string, ...);

script cve id It takes any number of unnamed string arguments. They usually looks like "CVE-2002-042".

DESCRIPTION

Sets the CVE IDs of the flaws tested by the script. It takes any number of unnamed string arguments. They usually looks like "CVE-2002-042".
The CVEs are stored as NVT references.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_cve_id("CVE-2016-8650", "CVE-2016-9793", "CVE-2017-2618", "CVE-2017-2636");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_category(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Dependencies (`doc/manual/nasl/built-in-functions/description-functions/script_dependencies.md`)

script_dependencies(3nasl)

NAME

script_dependencies - sets the lists of scripts that should be run before this one (if “optimize mode” is on).

SYNOPSIS

any script_dependencies(string, ...);

script dependencies It takes any number of unnamed string arguments.

DESCRIPTION

Sets the plugin's dependencies. Sets the lists of scripts that should be run before this one (if “optimize mode” is on).

RETURN VALUE

Returns nothing.

ERRORS

It requires at least one string as argument.

EXAMPLES

1:

cpp
script_dependencies("toolcheck.nasl", "host_alive_detection.nasl");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_category(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Exclude Keys (`doc/manual/nasl/built-in-functions/description-functions/script_exclude_keys.md`)

script_exclude_keys(3nasl)

NAME

script_exclude_keys - sets the list of “KB items” that must not be set to run this script in “optimize mode”.

SYNOPSIS

any script_exclude_keys(string, ...);

script exclude_keys takes any number of unnamed string arguments.

DESCRIPTION

Sets the list of “KB items” that must not be set to run this script in “optimize mode”.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_exclude_keys("Settings/disable_cgi_scanning");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_category(3nasl), script_mandatory_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Family (`doc/manual/nasl/built-in-functions/description-functions/script_family.md`)

script_family(3nasl)

NAME

script_family - sets the plugin's family.

SYNOPSIS

any script_family(string);

script family It takes one unnamed value.

DESCRIPTION

Sets the plugin's family.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_family("Ubuntu Local Security Checks");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Mandatory Keys (`doc/manual/nasl/built-in-functions/description-functions/script_mandatory_keys.md`)

script_mandatory_keys(3nasl)

NAME

script_mandatory_keys - sets the list of “KB items” that must be set to run this script.

SYNOPSIS

any script_mandatory_keys(string, ..., re: string);

script mandatory_keys takes any number of unnamed string arguments. Additionally it takes an optional named string argument re. With this option a specific required key has to contain a value defined with a regular expression. The re argument has to follow the specific pattern: re: '='.

DESCRIPTION

Sets the list of “KB items” that must be set to run this script.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_mandatory_keys("ssh/login/centos", "ssh/login/rpms", re:"ssh/login/release=CentOS7");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_category(3nasl), script_exclude_keys(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Name (`doc/manual/nasl/built-in-functions/description-functions/script_name.md`)

script_name(3nasl)

NAME

script_name - sets the plugin's name.

SYNOPSIS

any script_name(string);

script name It takes an unnamed string argument.

DESCRIPTION

The name can be change once the GVM versions older than GVM 11 (using VT name based preferences) reach the End of Life.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_name("Nmap (NASL wrapper)");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_oid(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Oid (`doc/manual/nasl/built-in-functions/description-functions/script_oid.md`)

script_oid(3nasl)

NAME

script_oid - sets the plugin's oid.

SYNOPSIS

any script_oid(string);

script oid It takes one unnamed value.

DESCRIPTION

Sets the plugin's oid.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_oid("1.3.6.1.4.1.25623.1.0.14259");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Require Keys (`doc/manual/nasl/built-in-functions/description-functions/script_require_keys.md`)

script_require_keys(3nasl)

REQUIRE_KEYS

script_require_keys - sets the list of “KB items” that must be set to run this script.

SYNOPSIS

any script_require_keys(string, ...);

script require_keys It takes any number of unnamed string arguments.

DESCRIPTION

Sets the list of “KB items” that must be set to run this script. This only applies if the option “optimize_test” is "yes".

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_require_keys("ftp/login");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Require Ports (`doc/manual/nasl/built-in-functions/description-functions/script_require_ports.md`)

script_require_ports(3nasl)

REQUIRE_PORTS

script_require_ports - sets the list of TCP ports that must be open to run this script in “optimize mode”.

SYNOPSIS

any script_require_ports(string, ..., int);

script require_ports It takes any number of unnamed integer or string arguments.

DESCRIPTION

Sets the list of TCP ports that must be open to run this script in “optimize mode”.

Note: Please see the non_simult_ports option of openvas(8) for some special handling of some ports.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_require_ports("Services/www", 443);

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Require Udp Ports (`doc/manual/nasl/built-in-functions/description-functions/script_require_udp_ports.md`)

script_require_udp_ports(3nasl)

REQUIRE_UDP_PORTS

script_require_udp_ports - sets the list of UDP ports that must be open to run this script in “optimize mode”.

SYNOPSIS

any script_require_udp_ports(string, ..., int);

script require_udp_ports It takes any number of unnamed integer or string arguments.

DESCRIPTION

Sets the list of UDP ports that must be open to run this script in “optimize mode”.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_require_udp_ports("Services/udp/sip", 5060);

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_oid(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Tag (`doc/manual/nasl/built-in-functions/description-functions/script_tag.md`)

script_tag(3nasl)

NAME

script_tag - sets additional information. Takes a named string argument:

SYNOPSIS

any script_tag(name: string, value: string);

script tag It takes two named arguments. The following are the supported tags:

  • last_modification date and time the script was last modified (Format: YYYY-MM-DD HH:mm:ss +0000 (Sat, 14 Oct YYYY))
  • creation_date date and time the script was created (Format: YYYY-MM-DD HH:mm:ss +0000 (Sat, 14 Oct YYYY))
  • severity_vector CVSSv3 vector if available, CVSSv2 otherwise (Added with GVM-21.04. No effect on previous versions)
  • severity_origin the origin of the CVSS vector. Possible values: (Added with GVM-21.04. No effect on previous versions)
    • NVD: if a CVE is the source
    • Vendor: if a vendor like Red Hat, Ubuntu, Cisco etc. is the source
    • Third Party: if a researcher, blog post , Vulnerability Reporter etc. is the source
    • Greenbone: if we added the CVSSv3 vector by ourselves without a source. (Note: If one or more CVEs are assigned to a VT but there was no CVSS score assessment of the NVD done yet one of the other possibilities should be used depending on the origin of the score.)
  • severity_date the date the CVSS vector was last modified. Format: LC_ALL=C date -u +"%F %T %z (%a, %d %b %Y)" (Added with GVM-21.04. No effect on previous versions)
  • cvss_base the CVSS computed from the cvss_base_vector
  • cvss_base_vector The CVSSv2 base vector
  • qod_type one of the following Quality of Detection types. If the type is not valid, a default (70%) is set. (Please note: Please either assign a QoD type OR alternatively a QoD value, NOT both):
    • exploit (qod: 100%): The detection happened via an exploit and is therefore fully verified.
    • remote_vul (99%): Remote active checks (code execution, traversal attack, SQL injection etc.) in which the response clearly shows the presence of the vulnerability.
    • remote_app (98%): Remote active checks (code execution, traversal attack, SQL injection etc.) in which the response clearly shows the presence of the vulnerable application.
    • package (97%): Authenticated package-based checks for Linux(oid) systems.
    • registry (97%): Authenticated registry based checks for Windows systems.
    • remote_active (95%): Remote active checks (code execution, traversal attack, SQL injection etc.) in which the response shows the likely presence of the vulnerable application or of the vulnerability. “Likely” means that only rare circumstances are possible in which the detection would be wrong.
    • remote_banner (80%): Remote banner check of applications that offer patch level in version. Many proprietary products do so.
    • executable_version (80%): Authenticated executable version checks for Linux(oid) or Windows systems where applications offer patch level in version.
    • remote_analysis (70%): Remote checks that do some analysis but which are not always fully reliable.
    • remote_probe (50%): Remote checks in which intermediate systems such as firewalls might pretend correct detection so that it is actually not clear whether the application itself answered. For example, this can happen for non-TLS connections.
    • remote_banner_unreliable (30%): Remote banner checks of applications that do not offer patch level in version identification. For example, this is the case for many open source products due to backport patches.
    • executable_version_unreliable (30%): Authenticated executable version checks for Linux(oid) systems where applications do not offer patch level in version identification.
    • general_note (1%): General note on potential vulnerability without finding any present application.
  • qod one of the above percentage values as string (Please note: Please either assign a QoD type OR alternatively a QoD value, NOT both)
  • solution_type This information shows possible solutions for the remediation of the vulnerability:
    • Workaround Information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability is available. There can be none, one or more workarounds available. This is usually the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
    • Mitigation Information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability is available but that does not resolve the vulnerability on the affected product. Mitigations may include using devices or access controls external to the affected product. Mitigations may or may not be issued by the original author of the affected product and they may or may not be officially sanctioned by the document producer.
    • Vendor fix Information is available about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
    • No fix available Currently there is no fix available. Information should contain details about why there is no fix.
    • Will not fix There is no fix for the vulnerability and there never will be one. This is often the case when a product has been orphaned, is no longer maintained or otherwise deprecated. Information should contain details about why there will be no fix issued.
  • summary Description of the vulnerability test (e.g.: "softwareXYZ is prone to multiple vulnerabilities."). This tag is mandatory!
  • vuldetect Description on the method used to detect the vulnerability (e.g.: "Checks if a vulnerable version is present on the target host.")
  • insight Some more details about the vulnerability (e.g.: "The flaw exists due to a buffer over-read error in the 'foo' function in path/to/file script."),
  • impact Details about the impact of the vulnerability (e.g.: "Successful exploitation allows an attacker to obtain sensitive information.")
  • affected Information about affected versions / software (e.g.: "SoftwareXYZ 1.3.7 and prior.")
  • solution Details how to remediate the vulnerability (e.g.: "Update to version 1.3.8 or later.")

DESCRIPTION

Sets additional information. The severity tags can be used just once.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_tag(name:"summary", value:"The remote host is missing one or more known mitigation(s) on Linux Kernel side for the referenced 'Meltdown' hardware vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks previous gathered information on the mitigation status reported by the Linux Kernel.");

  script_tag(name:"solution", value:"Enable the mitigation(s) in the Linux Kernel or update to a more recent Linux Kernel.");

  script_tag(name:"qod", value:"80");
  script_tag(name:"solution_type", value:"VendorFix");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_version(3nasl), script_xref(3nasl), script_oid(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Timeout (`doc/manual/nasl/built-in-functions/description-functions/script_timeout.md`)

script_timeout(3nasl)

NAME

script_timeout - sets the default timeout of the plugin.

SYNOPSIS

any script_timeout(int);

script timeout It takes an unnamed integer argument. If it is 0 or (-1), the timeout is infinite.sets the plugin's timeout.

DESCRIPTION

sets the default timeout of the plugin. It takes an unnamed integer argument. If it is 0 or (-1), the timeout is infinite.
It is stored in redis as a plugin preference with the reserved preference ID 0.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_timeout(320);

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_oid(3nasl), script_version(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Version (`doc/manual/nasl/built-in-functions/description-functions/script_version.md`)

script_version(3nasl)

NAME

script_version - sets the plugin's version.

SYNOPSIS

any script_version(string);

script version It takes an unnamed string argument (format: "YYYY-MM-DDTHH:mm:ss+0000").

DESCRIPTION

Sets the plugin's version.

RETURN VALUE

Returns nothing.

ERRORS

EXAMPLES

1:

cpp
script_version("2021-05-07T05:28:54+0000");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_oid(3nasl), script_xref(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Description Functions Script Xref (`doc/manual/nasl/built-in-functions/description-functions/script_xref.md`)

script_xref(3nasl)

NAME

script_xref - Add a cross reference to the meta data.

SYNOPSIS

any script_xref(string);

script xref takes one named string argument (name: "URL", value:LINK")

DESCRIPTION

The parameter "name" of the command defines actually the type, for example "URL" or "OSVDB".
The parameter "value" is the actual reference. Alternative to "value", "csv" can be used with a list of comma-separated values.

In fact, if name is "cve", it is equivalent to call script_cve_id(),
This even works with multiple comma-separated elements like
script_xref (name: "cve", csv: "CVE-2019-12345,CVE-2019-54321");

RETURN VALUE

Returns nothing.

ERRORS

  • If name is empty.
  • If no value and no cve

EXAMPLES

1:

cpp
script_xref(name:"URL", value:"https://www.debian.org/security/2008/dsa-1545");

2:

cpp
//if name is "cve" is identical to call script_cve_id()
script_xref (name: "cve", value: "CVE-2019-12345");

3:

cpp
//This even works with multiple comma-separated elements like
script_xref (name: "cve", csv: "CVE-2019-12345,CVE-2019-54321");

SEE ALSO

script_add_preference(3nasl), script_copyright(3nasl), script_cve_id(3nasl), script_dependencies(3nasl), script_exclude_keys(3nasl), script_mandatory_keys(3nasl), script_category(3nasl), script_family(3nasl), script_name(3nasl), script_require_keys(3nasl), script_require_ports(3nasl), script_require_udp_ports(3nasl), script_timeout(3nasl), script_oid(3nasl), script_version(3nasl), script_tag(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Glue Functions Get Preference (`doc/manual/nasl/built-in-functions/glue-functions/get_preference.md`)

get_preference(3nasl)

NAME

get_preference - get a preference

SYNOPSIS

string get_preference(0: string);

get_preference takes 1 positional argument

DESCRIPTION

This function is necessary to retrieve some preferences. Its argument is:
0. name of the argument to retrieve

RETURN VALUE

Value of the preference or NULL on error.

ERRORS

  • Preference does not exist

EXAMPLES

  1. Get the preference port_range:
c#
p = get_preference(’port_range’); # returns something like 1-65535

Doc Manual Nasl Built In Functions Glue Functions Get Script Oid (`doc/manual/nasl/built-in-functions/glue-functions/get_script_oid.md`)

get_script_oid(3nasl)

NAME

get_script_oid - get the OID of the current script

SYNOPSIS

string get_script_oid();

get_script_oid takes no arguments

DESCRIPTION

THis function returns the OID of the current script.

RETURN VALUE

OID of the current script

Doc Manual Nasl Built In Functions Glue Functions Notus (`doc/manual/nasl/built-in-functions/glue-functions/notus.md`)

notus(3nasl)

NAME

notus - Starts a notus scan with given data

SYNOPSIS

array notus(pkg_list: str, product: str);

notus two named arguments

DESCRIPTION

This function takes the given information and starts a notus scan. Its arguments are:
pkg_list: comma separated list of installed packages of the target system
product: identifier for the notus scanner to get list of vulnerable packages

In contrast to update_table_driven_lsc_data(3nasl)
this function does not publish results by itself, but returns a json like structure,
so information can be adjusted and must be published using
security_notus(3nasl). The json like format depends
one the scanner that is used. There are currently 2 scanner types available: Notus and
Skiron. Their response have different formats and also will be parsed differently. The
format for Notus has the following structure:

json
[
  0: {
    "oid": "[oid]",
    "vulnerable_packages": [{
      "name": "[package_name]",
      "installed": "[installed_version]",
      "fixed": {
        "version": "[fixed_version]",
        "specifier": "[specifier]"
      }
    }]
  },
  1: {
    "oid": "[oid]",
    "vulnerable_packages": [{
      "name": "[package_name]",
      "installed": "[installed_version]",
      "fixed": {
        "start": "[start_version]",
        "end": "[end_version]"
      }
    }]
  }
]

The root element is a list of results.
The elements can be accessed by using the normal NASL array handling. For more information see the example.

The format for Skiron has the following structure:

json
[
  {
    "oid": "[oid1]",
    "message": "[message1]"
  },
  {
    "oid": "[oid2]",
    "message": "[message2]"
  }
]

It is a list of dictionaries. Each dictionary has the key oid and message.

To determine which format is used, the builtin function notus_type(3nasl) can be used.

In case of an Error a NULL value is returned and an Error is set. The error can be gathered using the
notus_error(3nasl) function, which yields the last occurred error.

RETURN VALUE

This function returns an array of notus results

ERRORS

Possible errors

  • Missing function parameter
  • Unable to get result from Notus
  • Error while parsing Notus results
  • Unable to parse response

EXAMPLE

1 Run a manual table driven lsc and publish results:

cpp
package_list = 'libzmq3-dev-0:4.3.0-4+deb10u1\nlibzmq5-4.3.1-4+deb10u1\ndosbox-0.74-2-3+deb10u1';
product = "debian_10";

ret = notus(pkg_list: package_list, product: product);

foreach result (ret)
{
  security_notus(result: result);
}

2 Run a manual table driven lsc and access result fields:

cpp
package_list = 'libzmq3-dev-0:4.3.0-4+deb10u1\nlibzmq5-4.3.1-4+deb10u1\ndosbox-0.74-2-3+deb10u1';
product = "debian_10";

ret = notus(pkg_list: package_list, product: product);
type = notus_type();

if (type == 0) {
  foreach result (ret)
  {
    oid = result["oid"];
    vul_packages = result["vulnerable_packages"];
    foreach package (vul_packages)
    {
      name = package["name"];
      installed = package["installed"];
      fixed = package["fixed"];
      fixed_version = fixed["version"];
      if (fixed_version.isnull()) {
          start = fixed["start"];
          end = fixed["end"];
      } else {
          specifier = fixed["specifier"];
      }
    }
  }
} else if (type == 1) {
  foreach result (ret)
  {
    oid = result["oid"];
    message = result["message"]
  }
}

SEE ALSO

update_table_driven_lsc_data(3nasl), security_notus(3nasl), notus_error(3nasl), notus_type(3nasl)

Doc Manual Nasl Built In Functions Glue Functions Notus Error (`doc/manual/nasl/built-in-functions/glue-functions/notus_error.md`)

notus_error(3nasl)

NAME

notus_error - Get the last notus error as string

SYNOPSIS

str notus_error();

notus_error takes no arguments

DESCRIPTION

This function yields the last occurred error produced by the notus(3nasl) function.

RETURN VALUE

This function returns a error message as string

EXAMPLE

1 Run a manual table driven lsc and publish results:

cpp
package_list = 'libzmq3-dev-0:4.3.0-4+deb10u1\nlibzmq5-4.3.1-4+deb10u1\ndosbox-0.74-2-3+deb10u1';
product = "debian_10";

ret = notus(pkg_list: package_list, product: product);

if (!ret)
{
    display(notus_error());
}

SEE ALSO

notus(3nasl)

Doc Manual Nasl Built In Functions Glue Functions Notus Type (`doc/manual/nasl/built-in-functions/glue-functions/notus_type.md`)

notus_type(3nasl)

NAME

notus_type - Get the type of the notus result

SYNOPSIS

str notus_type();

notus_type takes no arguments

DESCRIPTION

This function yields the type of the notus result after calling the notus(3nasl) function.

RETURN VALUE

0 for Notus, 1 for Skiron

EXAMPLE

1 Run a manual table driven lsc and publish results:

cpp
package_list = 'libzmq3-dev-0:4.3.0-4+deb10u1\nlibzmq5-4.3.1-4+deb10u1\ndosbox-0.74-2-3+deb10u1';
product = "debian_10";

ret = notus(pkg_list: package_list, product: product);
type = notus_type();

if (type == 0)
{
    ...
} else if (type == 1) {
    ...
}

SEE ALSO

notus(3nasl)

Doc Manual Nasl Built In Functions Glue Functions Safe Checks (`doc/manual/nasl/built-in-functions/glue-functions/safe_checks.md`)

safe_checks(3nasl)

NAME

safe_checks - takes no argument and returns the boolean value of the “safe checks” option.

SYNOPSIS

bool safe_checks();

safe_checks takes no argument and returns the boolean value of the “safe checks” option.

DESCRIPTION

Dangerous plugins which may crash the remote service are expected to change their behavior when “safe checks” is on.

Usually, they just identify the service version (e.g. from the banner) and check if it is known as vulnerable.

In safe checks mode plugins from the most dangerous categories (ACT_DESTRUCTIVE_ATTACK, ACK_DENIAL and ACT_KILL_HOST) are not launched.
Meaning you do not need to test the value of safe_checks in those scripts.

EXAMPLES

cpp
if (safe_checks())
  exit(0);

SEE ALSO

exit(3nasl),

Doc Manual Nasl Built In Functions Glue Functions Script Get Preference (`doc/manual/nasl/built-in-functions/glue-functions/script_get_preference.md`)

script_get_preference(3nasl)

NAME

script_get_preference - get the value of a plugin preference

SYNOPSIS

string script_get_preference(id: int, 0: string);

script_get_preference takes 1 optional named argument and 1 optional positional argument.

DESCRIPTION

Get the value of a plugin preference. Its arguments are:
id: the preference ID.
0. the name of the preference to get

At least one argument is required to get the preference. If both are given, the ID has priority.

RETURN VALUE

The value of the preference or NULL on error

ERRORS

  • no argument was given
  • the preference does not exist

Doc Manual Nasl Built In Functions Glue Functions Script Get Preference File Content (`doc/manual/nasl/built-in-functions/glue-functions/script_get_preference_file_content.md`)

script_get_preference_file_content(3nasl)

NAME

script_get_preference_file_content - get the file contents of a plugins preference that is of type "file"

SYNOPSIS

string script_get_preference_file_content(0: string);

script_get_preference_file_content takes up to 2 named arguments

DESCRIPTION

As files sent to the scanner (e.g. as plugin preference) are stored in a hash table with an identifier supplied by the client as the key, the contents have to be looked up.

Its argument is:
0. name of the preference

RETURN VALUE

Content of the file or NULL on error

ERRORS

  • no argument was given
  • the preference is not of type file

Doc Manual Nasl Built In Functions Glue Functions Script Get Preference File Location (`doc/manual/nasl/built-in-functions/glue-functions/script_get_preference_file_location.md`)

script_get_preference_file_location(3nasl)

NAME

script_get_preference_file_location - get the location of a plugin preference of type "file"

SYNOPSIS

string script_get_preference_file_location(0: string);

script_get_preference_file_location takes 1 positional argument.

DESCRIPTION

As files sent to the server (e.g. as plugin preference) are stored at pseudo-random locations with different names, the "real" file name has to be looked up in a hash table.

Its argument is:
0. name of the preference

RETURN VALUE

Location of the preference or NULL on error.

ERRORS

  • no argument was given
  • the preference is not of type file

Doc Manual Nasl Built In Functions Glue Functions Update Table Driven Lsc Data (`doc/manual/nasl/built-in-functions/glue-functions/update_table_driven_lsc_data.md`)

update_table_driven_lsc_data(3nasl)

NAME

DEPRECATED

update_table_driven_lsc_data - Set information, so that openvas can start a table driven lsc

SYNOPSIS

void update_table_driven_lsc_data(pkg_list: str, os_release: str);

update_table_driven_lsc_data two named arguments

DESCRIPTION

This function sets internal KB items ssh/login/package_list_notus and ssh/login/release_notus with the given arguments:
pkg_list: comma separated list of installed packages of the target system
os_release: identifier for the operating system of the target system

After the KB items are set, these information is also transferred to the main process and a notus scan is triggered. The
results of the notus scan are then directly published.

DEPRECATED

This function is deprecated and notus(3nasl) and security_notus(3nasl) should be used instead.

RETURN VALUE

This function returns nothing.

SEE ALSO

log_message(3nasl),
notus(3nasl),
security_notus(3nasl)

Doc Manual Nasl Built In Functions Glue Functions Vendor Version (`doc/manual/nasl/built-in-functions/glue-functions/vendor_version.md`)

vendor_version(3nasl)

NAME

vendor_version - get vendor version

SYNOPSIS

string vendor_version();

vendor_version takes no arguments

DESCRIPTION

This function just returns the vendor version.

RETURN VALUE

The vendor version.

Doc Manual Nasl Built In Functions Host Functions TARGET IS IPV6 (`doc/manual/nasl/built-in-functions/host-functions/TARGET_IS_IPV6.md`)

TARGET_IS_IPV6(3nasl)

NAME

TARGET_IS_IPV6 - check if the currently scanned target is an IPv6 address

SYNOPSIS

bool TARGET_IS_IPV6();

TARGET_IS_IPV6 takes no arguments

DESCRIPTION

Check if the currently scanned target is an IPv6 address.

RETURN VALUE

TRUE if the current target is an IPv6 address, else FALSE. In case of an error, NULL is returned.

ERROR

No IP address for the current target is set.

Doc Manual Nasl Built In Functions Host Functions Add Host Name (`doc/manual/nasl/built-in-functions/host-functions/add_host_name.md`)

add_host_name(3nasl)

NAME

add_host_name - add a host name to the vhost list

SYNOPSIS

void add_host_name(hostname: string, source: string);

add_host_name takes up to 2 named arguments

DESCRIPTION

Expands the vHosts list with the given hostname.

The mandatory parameter hostname is of type string. It contains the hostname which should be added to the list of vHosts

Additionally a source, how the hostname was detected can be added with the named argument source as a string. If it is not given, the value NASL is set as default.

RETURN VALUE

None

ERRORS

The named argument hostname is missing.

Doc Manual Nasl Built In Functions Host Functions Get Host Name (`doc/manual/nasl/built-in-functions/host-functions/get_host_name.md`)

get_host_name(3nasl)

NAME

get_host_name - get the currently scanned host

SYNOPSIS

string get_host_name();

get_host_name takes no arguments

DESCRIPTION

Get the host name of the currently scanned target. If there is no host name available, the IP of the target is returned instead.

RETURN VALUE

Return the found host name or IP as string

Doc Manual Nasl Built In Functions Host Functions Get Host Name Source (`doc/manual/nasl/built-in-functions/host-functions/get_host_name_source.md`)

get_host_name_source(3nasl)

NAME

get_host_name_source - get the hostname source

SYNOPSIS

string get_host_name_source(hostname: string);

get_host_name_source takes one named argument

DESCRIPTION

This function returns the source of detection of a given hostname.

The named parameter hostname is a string containing the hostname.

When no hostname is given, the current scanned host is taken.

If no virtual hosts are found yet this function always returns IP-address.

RETURN VALUE

Source of detection of a given hostname as string or NULL if hostname unknown

SEE ALSO

add_host_name(3nasl)

Doc Manual Nasl Built In Functions Host Functions Get Host Names (`doc/manual/nasl/built-in-functions/host-functions/get_host_names.md`)

get_host_names(3nasl)

NAME

get_host_names - get a list with found hostnames

SYNOPSIS

array get_host_names();

get_host_names takes no arguments

DESCRIPTION

Get a list of found hostnames or a IP of the current target in case no hostnames were found yet.

RETURN VALUE

An array containing all found hostnames as string. The return type is always a NASL array.

SEE ALSO

add_host_name(3nasl)

Doc Manual Nasl Built In Functions Host Functions Ip Reverse Lookup (`doc/manual/nasl/built-in-functions/host-functions/ip_reverse_lookup.md`)

ip_reverse_lookup(3nasl)

NAME

ip_reverse_lookup - gets the host name of either the given IP address or the current target

SYNOPSIS

string ip_reverse_lookup( string );

Takes an optional string parameter, which is the IP address to look up. If no parameter is given, the IP address of the current target is used.

DESCRIPTION

This function uses the gethostbyaddr function to get the host name of the given IP address. If no IP address is given, the IP address of the current target is used.

RETURN VALUE

Return the found host name or NULL if the host name could not be retrieved.

Doc Manual Nasl Built In Functions Host Functions Resolve Host Name (`doc/manual/nasl/built-in-functions/host-functions/resolve_host_name.md`)

resolve_host_name(3nasl)

NAME

resolve_host_name - get an IP address corresponding to the host name

SYNOPSIS

string resolve_host_name(hostname: string);

resolve_host_name takes one named argument

DESCRIPTION

Tries to resolve the IP of a given hostname as IPv6.

The named parameter hostname is a string containing the hostname to resolve.

RETURN VALUE

The resolve IPv6 as string or NULL, when the hostname could not be resolved or on an error

ERRORS

The named parameter hostname is missing

Doc Manual Nasl Built In Functions Host Functions Resolve Hostname To Multiple Ips (`doc/manual/nasl/built-in-functions/host-functions/resolve_hostname_to_multiple_ips.md`)

resolve_hostname_to_multiple_ips(3nasl)

NAME

resolve_hostname_to_multiple_ips - resolve a hostname to all found addresses

SYNOPSIS

array resolve_hostname_to_multiple_ips(hostname: string);

resolve_hostname_to_multiple_ips takes one named argument

DESCRIPTION

This function creates a list of addresses a given host resolves to.

The named argument hostname is a string containing the hostname to resolve.

RETURN VALUE

A array containing all found addresses or NULL on error.

ERROR

The named parameter hostname is missing

NOTE

Even if no address could be found, an empty NASL array is returned. A NASL array is always resolved to TRUE value even though it is empty.

Doc Manual Nasl Built In Functions Host Functions Same Host (`doc/manual/nasl/built-in-functions/host-functions/same_host.md`)

same_host(3nasl)

NAME

same_host - compare two hosts

SYNOPSIS

bool same_host(0: string, 1: string, cmp_hostname: bool);

same_host takes two unnamed arguments and one named argument

DESCRIPTION

Compare if two hosts are the same.

The first two unnamed arguments are string containing the host to compare

If the named argument cmp_hostname is set to TRUE, the given hosts are resolved into their hostnames

RETURN VALUE

TRUE if both hosts are the same, else FALSE. In case of an error a NULL is returned instead

ERRORS

One of the two positional arguments are missing

One of the hostnames is too long, max length: 255

Doc Manual Nasl Built In Functions Http Functions Cgibin (`doc/manual/nasl/built-in-functions/http-functions/cgibin.md`)

cgibin(3nasl)

NAME

cgibin - Get the cgi-bin path elements.

SYNOPSIS

void cgibin();

cgibin takes no argument.

DESCRIPTION

Returns the cgi-bin path elements. In fact the NASL interpreter forks and each process gets one value.

RETURN VALUE

String containing the path.

EXAMPLES

1 Get and display the path:

cpp
path = cgibin();
display (path);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Close Socket (`doc/manual/nasl/built-in-functions/http-functions/http_close_socket.md`)

http_close_socket(3nasl)

NAME

http_close_socket - closes a socket.

SYNOPSIS

void http_close_socket(int);

http_close_socket takes one unnamed argument

DESCRIPTION

It is identical to close but this may change in the future.

RETURN VALUE

EXAMPLES

1 Open and close a socket. Use the socket to send a get request:

cpp
soc = http_open_socket (port: 80);

url = "http://localhost/";
file = url + "index.html";
req = http_get(port: 80, item: file);

send(socket: soc, data: req);
r = http_recv_headers2(socket:soc);
display (r);

http_close_socket(soc);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Delete (`doc/manual/nasl/built-in-functions/http-functions/http_delete.md`)

http_delete(3nasl)

NAME

http_delete - formats an HTTP DELETE request for the server on the port.

SYNOPSIS

void http_delete(port: int, item: string, data: string);

http_delete takes three named arguments.

DESCRIPTION

Formats an HTTP DELETE request for the server on the port.
It will automatically handle the HTTP version and the basic or cookie based authentication. The arguments are port and item (the URL). data argument is not compulsory and probably useless in this function.

RETURN VALUE

It returns a string (the formatted request). Null on error

EXAMPLES

1 Get and display the delete request:

cpp
url = "http://localhost/";
file = url + "puttest" + rand() + ".html";
req = http_delete(port: 80, item: file);
display (req);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Get (`doc/manual/nasl/built-in-functions/http-functions/http_get.md`)

http_get(3nasl)

NAME

http_get - formats an HTTP DELETE request for the server on the port.

SYNOPSIS

void http_get(port: int, item: string, data: string);

http_get takes three named arguments.

DESCRIPTION

Formats an HTTP DELETE request for the server on the port.
It will automatically handle the HTTP version and the basic or cookie based authentication. The arguments are port and item (the URL). data argument is not compulsory and probably useless in this function.

RETURN VALUE

It returns a string (the formatted request). Null on error

EXAMPLES

1 Get and display the delete request:

cpp
url = "http://localhost/";
file = url + "index.html";
req = http_get(port: 80, item: file);
display (req);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Head (`doc/manual/nasl/built-in-functions/http-functions/http_head.md`)

http_head(3nasl)

NAME

http_head - formats an HTTP HEAD request for the server on the port.

SYNOPSIS

void http_head(port: int, item: string, data: string);

http_head takes three named arguments.

DESCRIPTION

Formats an HTTP HEAD request for the server on the port.
It will automatically handle the HTTP version and the basic or cookie based authentication. The arguments are port and item (the URL). data argument is not compulsory and probably useless in this function.

RETURN VALUE

It returns a string (the formatted request). Null on error

EXAMPLES

1 Get and display the head request:

cpp
req = http_head(port: 80, item: "/~root");
display (req);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Open Socket (`doc/manual/nasl/built-in-functions/http-functions/http_open_socket.md`)

http_open_socket(3nasl)

NAME

http_open_socket - opens a socket.

SYNOPSIS

void http_open_socket(int);

http_open_socket takes one unnamed argument

DESCRIPTION

Opens a socket to the given port. It sets a 64K buffer for IO.

RETURN VALUE

An integer value, the socket

EXAMPLES

1 Open and close a socket. Use the socket to send a get request:

cpp
soc = http_open_socket (port: 80);

url = "http://localhost/";
file = url + "index.html";
req = http_get(port: 80, item: file);

send(socket: soc, data: req);
r = http_recv_headers2(socket:soc);
display (r);

http_close_socket(soc);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Post (`doc/manual/nasl/built-in-functions/http-functions/http_post.md`)

http_post(3nasl)

NAME

http_post - formats an HTTP POST request for the server on the port.

SYNOPSIS

void http_post(port: int, item: string, data: string);

http_post takes three named arguments.

DESCRIPTION

Formats an HTTP POST request for the server on the port.
It will automatically handle the HTTP version and the basic or cookie based authentication. The arguments are port and item (the URL) and data.

RETURN VALUE

It returns a string (the formatted request). Null on error

EXAMPLES

1 Get and display the formatted post request:

cpp
data = "some data";
req = http_post(port: 80, item: "http://localhost/index.html", data: data);
display (req);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http Functions Http Put (`doc/manual/nasl/built-in-functions/http-functions/http_put.md`)

http_put(3nasl)

NAME

http_put - formats an HTTP PUT request for the server on the port.

SYNOPSIS

void http_put(port: int, item: string, data: string);

http_put takes three named arguments.

DESCRIPTION

Formats an HTTP PUT request for the server on the port.
It will automatically handle the HTTP version and the basic or cookie based authentication. The arguments are port and item (the URL) and data.

RETURN VALUE

It returns a string (the formatted request). Null on error

EXAMPLES

1 Get and display the formatted put request:

cpp
data = "some data";
req = http_put(port: 80, item: "http://localhost/index.html", data: data);
display (req);

SEE ALSO

cgibin(3nasl), http_delete(3nasl), http_get(3nasl), http_close_socket(3nasl), http_head(3nasl), http_open_socket(3nasl), http_post(3nasl), http_put(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Close Handle (`doc/manual/nasl/built-in-functions/http2-functions/http2_close_handle.md`)

http2_close_handle(3nasl)

NAME

http2_close_handle - Close a handle for http requests previously initialized.

SYNOPSIS

void http_close_handle(handle: int);

http_close_handle takes one argument.

DESCRIPTION

Close a handle for http requests previously initialized.

RETURN VALUE

It returns an integer or NULL on error.

EXAMPLES

1 Close the handle identifier

cpp
h = http2_handle();
display(h);
http2_close_handle(h);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Delete (`doc/manual/nasl/built-in-functions/http2-functions/http2_delete.md`)

http2_delete(3nasl)

NAME

http2_delete - performs an HTTP2 DELETE request for the server on the port.

SYNOPSIS

void http_delete(handle: int, port: int, schema: string, item: string, data: string);

http_delete takes five named arguments.

DESCRIPTION

Performs an HTTP2 DELETE request for the server on the port. It tries to force the version HTTP2 if https (default) is passed as schema uses ALPN to negotiate the protocol to use.

If http is passed as schema, the function includes an upgrade header in the initial request to the host to allow upgrading to HTTP/2.
The arguments are port and item (the path, query, etc), schema (optional, default https) and data (optional).

RETURN VALUE

It returns a string (the http response). Null on error

EXAMPLES

1 Delete and display the formatted delete request:

cpp
h = http2_handle();
display(h);

r = http2_delete(handle:h, port:3000, item:"/vts", schema:"http");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Get (`doc/manual/nasl/built-in-functions/http2-functions/http2_get.md`)

http2_get(3nasl)

NAME

http2_get - performs an HTTP2 GET request for the server on the port.

SYNOPSIS

void http_get(handle: int, port: int, schema: string, item: string, data: string);

http_get takes five named arguments.

DESCRIPTION

Performs an HTTP2 GET request for the server on the port. It tries to force the version HTTP2 if https (default) is passed as schema uses ALPN to negotiate the protocol to use.

If http is passed as schema, the function includes an upgrade header in the initial request to the host to allow upgrading to HTTP/2.
The arguments are port and item (the path, query, etc), schema (optional, default https) and data (optional).

RETURN VALUE

It returns a string (the http response). Null on error

EXAMPLES

1 Get and display the formatted get request:

cpp
h = http2_handle();
display(h);

r = http2_get(handle:h, port:3000, item:"/vts", schema:"http");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Get Response Code (`doc/manual/nasl/built-in-functions/http2-functions/http2_get_response_code.md`)

http2_get_response_code(3nasl)

NAME

http2_get_response_code - Gets the response code

SYNOPSIS

void http2_get_response_code(handle: int);

http_get takes one argument.

DESCRIPTION

After performing a request, is possible to get the response code calling this function and giving the handle identifier.

RETURN VALUE

It returns an intenger with the response code. Null on error

EXAMPLES

1 Get and display the response code:

cpp
h = http2_handle();
display(h);

r = http2_get(handle:h, port:3000, item:"/vts", schema:"http");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Handle (`doc/manual/nasl/built-in-functions/http2-functions/http2_handle.md`)

http2_handle(3nasl)

NAME

http2_handle - Creates a handle for http requests.

SYNOPSIS

void http_handle(ca_cert: string);

http_handle takes one optional named argument.

DESCRIPTION

Initialize a handle for performing http requests. It optionally receives a CA certificate in PEM format for performing peer verification.

RETURN VALUE

It returns an integer or NULL on error.

EXAMPLES

1 Get the handle identifier

cpp
h = http2_handle();
display(h);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Head (`doc/manual/nasl/built-in-functions/http2-functions/http2_head.md`)

http2_head(3nasl)

NAME

http2_head - performs an HTTP2 HEAD request for the server on the port.

SYNOPSIS

void http_head(handle: int, port: int, schema: string, item: string, data: string);

http_head takes five named arguments.

DESCRIPTION

Performs an HTTP2 HEAD request for the server on the port. It tries to force the version HTTP2 if https (default) is passed as schema uses ALPN to negotiate the protocol to use.

If http is passed as schema, the function includes an upgrade header in the initial request to the host to allow upgrading to HTTP/2.
The arguments are port and item (the path, query, etc), schema (optional, default https) and data (optional).

RETURN VALUE

It returns a string (the http response). Null on error

EXAMPLES

1 Get and display the formatted head request:

cpp
h = http2_handle();
display(h);

r = http2_head(handle:h, port:3000, item:"/", schema:"http");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Post (`doc/manual/nasl/built-in-functions/http2-functions/http2_post.md`)

http2_post(3nasl)

NAME

http2_post - performs an HTTP2 POST request for the server on the port.

SYNOPSIS

void http_post(handle: int, port: int, schema: string, item: string, data: string);

http_post takes five named arguments.

DESCRIPTION

Performs an HTTP2 POST request for the server on the port. It tries to force the version HTTP2 if https (default) is passed as schema uses ALPN to negotiate the protocol to use.

If http is passed as schema, the function includes an upgrade header in the initial request to the host to allow upgrading to HTTP/2.
The arguments are port and item (the path, query, etc), schema (optional, default https) and data (optional).

RETURN VALUE

It returns a string (the http response). Null on error

EXAMPLES

1 Get and display the formatted post request:

cpp
h = http2_handle();
display(h);

r = http2_post(handle:h, port:3000, item:"/scan", schema:"http", data:"bad scan config format");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Put (`doc/manual/nasl/built-in-functions/http2-functions/http2_put.md`)

http2_put(3nasl)

NAME

http2_put - performs an HTTP2 PUT request for the server on the port.

SYNOPSIS

void http_put(handle: int, port: int, schema: string, item: string, data: string);

http_put takes five named arguments.

DESCRIPTION

Performs an HTTP2 PUT request for the server on the port. It tries to force the version HTTP2 if https (default) is passed as schema uses ALPN to negotiate the protocol to use.

If http is passed as schema, the function includes an upgrade header in the initial request to the host to allow upgrading to HTTP/2.
The arguments are port and item (the path, query, etc), schema (optional, default https) and data (optional).

RETURN VALUE

It returns a string (the http response). Null on error

EXAMPLES

1 Get and display the formatted put request:

cpp
h = http2_handle();
display(h);

r = http2_put(handle:h, port:3000, item:"/scan", schema:"http", data:"bad scan config format");
display("response: ", r);
rc = http2_get_response_code(handle:h);
display("return code: ", rc);

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Http2 Functions Http2 Set Custom Header (`doc/manual/nasl/built-in-functions/http2-functions/http2_set_custom_header.md`)

http2_set_custom_header(3nasl)

NAME

http2_set_custom_header - Set a custom header element in the header

SYNOPSIS

void http_set_custom_header(handle: int, header_item: string);

http_set_custom_header takes two arguments.

DESCRIPTION

Adds a new element to initialized handle header.

RETURN VALUE

It returns an integer or NULL on error.

EXAMPLES

1 Set a new element in the header

cpp
h = http2_handle();
display(h);
http2_set_custom_header(handle: h, handle_item: "Content-Type: application/json");

SEE ALSO

http2_delete(3nasl), http2_get(3nasl), http2_close_handle(3nasl), http2_head(3nasl), http2_handle(3nasl), http2_post(3nasl), http2_put(3nasl), http2_get_response_code(3nasl), http2_set_custom_header(3nasl)

Doc Manual Nasl Built In Functions Isotime Functions Isotime Add (`doc/manual/nasl/built-in-functions/isotime-functions/isotime_add.md`)

isotime_add(3nasl)

NAME

isotime_add - add years, days or seconds to an ISO time string

SYNOPSIS

string isotime_add(0: string, years: int, days: int, seconds: int);

isotime_add takes 1 positional and up to 3 named arguments.

DESCRIPTION

Adds given years, days and seconds to a given ISO time string.

The first positional argument is a string containing an ISO time string.

The named argument years is an int containing the number of years to add to the ISO time string

The named argument days is an int containing the number of days to add to the ISO time string

The named argument seconds is an int containing the number of seconds to add to the ISO time string

RETURN VALUE

The resulting ISO time as string or NULL on error

ERRORS

The first positional argument containing the ISO time string is missing or invalid.

The result would overflow, i.e. year >9999.

Doc Manual Nasl Built In Functions Isotime Functions Isotime Is Valid (`doc/manual/nasl/built-in-functions/isotime-functions/isotime_is_valid.md`)

isotime_is_valid(3nasl)

NAME

isotime_is_valid - check if a ISO time string is valid

SYNOPSIS

bool isotime_is_valid(0: string);

isotime_is_valid takes 1 positional argument.

DESCRIPTION

Checks the validity for a given ISO time string. Valid strings are both the standard 15 byte string (yyyymmddThhmmss) and the better human readable up to 19 byte (yyyy-mm-dd[ hh[:mm[:ss]]]) are valid.

The first unnamed argument is the string to be checked.

RETURN VALUE

A bool either TRUE or FALSE

Doc Manual Nasl Built In Functions Isotime Functions Isotime Now (`doc/manual/nasl/built-in-functions/isotime-functions/isotime_now.md`)

isotime_now(3nasl)

NAME

isotime_now - get the current time in the standard ISO format

string isotime_now();

isotime_now takes no arguments

DESCRIPTION

If available get the current time in the standard ISO time format (yyyymmddThhmmss).

RETURN VALUE

The current ISO time as string or NULL if no time is available.

Doc Manual Nasl Built In Functions Isotime Functions Isotime Print (`doc/manual/nasl/built-in-functions/isotime-functions/isotime_print.md`)

isotime_print(3nasl)

NAME

isotime_print - convert ISO time string to a better readable form

string isotime_print(0: string);

isotime_print takes one positional argument.

DESCRIPTION

Convert a standard isotime (yyyymmddThhmmss) into the human readable variant (yyyy-mm-dd hh:mm:ss).

The first unnamed argument is a string containing the string to convert.

RETURN VALUE

The ISO time in a human readable form as string or NULL on error.

ERRORS

First unnamed argument is either missing or in the wrong format.

Doc Manual Nasl Built In Functions Isotime Functions Isotime Scan (`doc/manual/nasl/built-in-functions/isotime-functions/isotime_scan.md`)

isotime_scan(3nasl)

NAME

isotime_scan - convert a string into an ISO time string

string isotime_scan(0: string);

isotime_scan takes 1 positional argument.

DESCRIPTION

Convert a standard isotime (yyyymmddThhmmss) or a human readable variant (yyyy-mm-dd[ hh[:mm[:ss]]]) into the standard isotime (yyyymmddThhmmss).

The first unnamed argument is a string containing the string to convert.

RETURN VALUE

The standard ISO time as string or NULL on error.

ERRORS

First unnamed argument is missing.

Given string is too short.

Unable to convert string.

Doc Manual Nasl Built In Functions Knowledge Base Get Kb Item (`doc/manual/nasl/built-in-functions/knowledge-base/get_kb_item.md`)

get_kb_item(3nasl)

NAME

get_kb_item - retrieves an entry from the KB

SYNOPSIS

any get_kb_item(0: string);

get_kb_item takes 1 positional argument.

DESCRIPTION

This function is used to retrieve entries from the KB. It is mainly used for inter-plugin communication, so data can be transferred between scripts.

If the item is a list, the plugin will fork and each child process will use a different value. The openvas-scanner does NOT remember which child got which value: reading the same item a second time will fork again! You should not call this function when some connections are open if you do not want to see several processes fighting to read or write on the same socket. Although it is internally based on forking, execution of a script is NOT parallel.

The first positional argument determines the name of the entry, which should be retrieved.

RETURN VALUE

KB item, either int or string or None, when key does not exist

EXAMPLES

1: Create an entry, and get it

cpp
set_kb_item(name: "foo", value: "bar");
display(get_kb_item("foo"));
# should print bar

2: Create multiple entries and get them by forking

cpp
set_kb_item(name: "hosts", value: "foo");
set_kb_item(name: "hosts", value: "bar");
display(get_kb_item("hosts"));
# should print two lines, one with foo and one with bar

NOTES

To avoid forking use get_kb_list(3nasl) instead

SEE ALSO

set_kb_item(3nasl), get_kb_list(3nasl), replace_kb_item(3nasl), get_host_kb_index(3nasl), display(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Knowledge Base Get Kb List (`doc/manual/nasl/built-in-functions/knowledge-base/get_kb_list.md`)

get_kb_list(3nasl)

NAME

get_kb_list - retrieves multiple entries from the KB

SYNOPSIS

any get_kb_list(0: string);

get_kb_list takes 1 positional argument.

DESCRIPTION

This function is used to retrieve entries from the KB in a list. It is mainly used for inter-plugin communication, so data can be transferred between scripts.

The first positional argument determines the name of the entry, which should be retrieved. Alternatively a mask can be given to match multiple KB entries

RETURN VALUE

KB items as a list of key-value pairs or None if array size is 0

ERRORS

first positional argument is not given

EXAMPLES

1: Create a list with expiring keys and display it

cpp
set_kb_item(name: "hosts", value: "foo", expire: 600);
set_kb_item(name: "hosts", value: "bar", expire: 600);

display(get_kb_list("hosts"));
# should print [ hosts: 'foo', boo: 'baz' ]

SEE ALSO

set_kb_item(3nasl), get_kb_item(3nasl), replace_kb_item(3nasl), get_host_kb_index(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Knowledge Base Replace Kb Item (`doc/manual/nasl/built-in-functions/knowledge-base/replace_kb_item.md`)

replace_kb_item(3nasl)

NAME

replace_kb_item - creates a new entry in the KB or replace the old value

SYNOPSIS

void replace_kb_item(name: string, value: any);

replace_kb_item takes 2 named arguments.

DESCRIPTION

This function is used to create new entries within the KB or replace existing ones. It is mainly used for inter-plugin communication, so data can be transferred between scripts. If this function is called multiple times with the same name, the old value is replaced.

The name parameter sets the name of the entry. It is used to retrieve the item again with get_kb_item(3nasl).

The value parameter sets the value of the entry. It can store any information provided and can be retrieved again with get_kb_item(3nasl). The type of the value can be either an integer or a string. If the value is of type integer, it is not possible to set it to -1.

RETURN VALUE

None

ERRORS

parameter name is missing

parameter value is missing

parameter value is int and its value is -1

EXAMPLES

1: Create an entry

cpp
replace_kb_item(name: "foo", value: "bar");

2: Create an entry and replace it

cpp
replace_kb_item(name: "foo", value: "bar");
replace_kb_item(name: "foo", value: "baz");

SEE ALSO

get_kb_item(3nasl), get_kb_list(3nasl), set_kb_item(3nasl), get_host_kb_index(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Knowledge Base Set Kb Item (`doc/manual/nasl/built-in-functions/knowledge-base/set_kb_item.md`)

set_kb_item(3nasl)

NAME

set_kb_item - creates a new entry in the KB

SYNOPSIS

void set_kb_item(name: string, value: any);

void set_kb_item(name: string, value: any, expire: int);

set_kb_item takes either 2 or 3 named arguments.

DESCRIPTION

This function is used to create new entries within the KB. It is mainly used for inter-plugin communication, so data can be transferred between scripts. If this function is called multiple times with the same name, a list is created.

The name parameter sets the name of the entry. It is used to retrieve the item again with get_kb_item().

The value parameter sets the value of the entry. It can store any information provided and can be retrieved again with get_kb_item(). The type of the value can be either an integer or a string.

The expire parameter is used for volatile entries. It is optional and determines when the entry expires in seconds. This value is only relevant, when the options maxmemory and maxmemory-policy are set in the redis.conf entries with an expire set will be evicted when maxmemory is reached. This way memory issues can be prevent.

RETURN VALUE

None

ERRORS

parameter name is missing

parameter value is missing

parameter value is int and its value is -1

parameter expire is -1

EXAMPLES

1: Create an entry, which expires after 10 minutes

cpp
set_kb_item(name: "foo", value: "bar", expire: 600);

2: Create an entry, which does not expire

cpp
set_kb_item(name: "age", value: "42");

3: Create a list

cpp
set_kb_item(name: "hosts", value: "foo");
set_kb_item(name: "hosts", value: "bar");

NOTES

When to use expire: Should be used as often as possible. Should
be used for the webpage caching functions. Should be used for
keys which are not 100% necessary and which can be deleted if we
run into memory limits. Should be used for large keys. Should be
used for keys which are only needed for a short amount of time.

SEE ALSO

get_kb_item(3nasl), get_kb_list(3nasl), replace_kb_item(3nasl), get_host_kb_index(3nasl), openvas-nasl(1)

Doc Manual Nasl Built In Functions Krb5 Krb5 Error Code To String (`doc/manual/nasl/built-in-functions/krb5/krb5_error_code_to_string.md`)

krb5_error_code_to_string(3nasl)

NAME

krb5_error_code_to_string - Returns a string representation of either the given code or the cached code.

SYNOPSIS

str krb5_error_code_to_string(int);

DESCRIPTION

Returns a string representation of either the given code or the cached code.

The cached code reflects the error code of the last krb5 function call.

RETURN VALUE

Returns a human readable version of the result code.

EXAMPLES

nasl
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
        display(krb5_error_code_to_string(result));
}
display(krb5_error_code_to_string());

Doc Manual Nasl Built In Functions Krb5 Krb5 Find Kdc (`doc/manual/nasl/built-in-functions/krb5/krb5_find_kdc.md`)

krb5_find_kdc(3nasl)

NAME

krb5_find_kdc - Find the KDC for a given realm.

SYNOPSIS

string krb5_find_kdc(realm: string);

insstr takes named argument realm.

DESCRIPTION

This function opens the krb5.conf file (located either by environment variable KRB5_CONFIG or /etc/ktrb5.conf) and looks for an kdc entry for the given realm.

RETURN VALUE

The found KDC or NULL if the KDC could not be found.

ERRORS

Returns NULL if the realm is not found or the krb5.conf file could not be opened.

EXAMPLES

c#
kdc = insstr(realm: 'EXAMPLE.COM');
display(kdc);

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Init (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_init.md`)

krb5_gss_init(3nasl)

NAME

krb5_gss_init - initialize the krb5 GSS-API library.

SYNOPSIS

int krb5_gss_init();

krb5_gss_init takes no arguments.

DESCRIPTION

Initializes the krb5 GSS-API library. This function can be omitted when gss_prepare_context is called.

When there is an already initialized context it will be destroyed and a new one will be created.

RETURN VALUE

Returns 0 on success otherwise it is an failure.

EXAMPLES

c#
result = krb5_gss_init();
if (krb5_is_failure(result)) {
	exit(42);
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Prepare Context (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_prepare_context.md`)

krb5_gss_prepare_context(3nasl)

NAME

krb5_gss_prepare_context - Creates the initial ticket request for the krb5 GSS-API library and prepares the context for further use.

SYNOPSIS

int krb5_gss_prepare_context(config_patn: str, realm: str, kdc: str, host: str, service: str, user: str, password: str);

The config_path argument is optional and can be omitted. When it is not set it tries to read it from the KRB5_CONFIG environment variables and falls back to /etc/krb5.conf. The other arguments are required.

  • realm - The realm of the domain.
  • kdc - The KDC server to use. Can be a comma separated list of servers. The first server in the list is the primary server.
  • host - The host to use for the ticket request. Usually the host where the service is running.
  • service - The service to request the ticket for.
  • user - The user to request the ticket for.
  • password - The password of the user.

DESCRIPTION

When krb5_gss_prepare_context is called it creates the initial ticket request for the krb5 GSS-API library and prepares the context for further use.

It can be used directly without calling krb5_gss_init first.

RETURN VALUE

Returns 0 on success otherwise it is an failure.

EXAMPLES

c#
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
	exit(42);
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Session Key (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_session_key.md`)

krb5_gss_session_key(3nasl)

NAME

krb5_gss_session_key - Returns the session key or NULL if none was found.

SYNOPSIS

str krb5_gss_update_context_session_key();

DESCRIPTION

Returns the session key found within the context when the last krb5_gss_update_context was called. If no session key was found, NULL is returned.

RETURN VALUE

Returns the session key or NULL if none was found.

EXAMPLES

nasl
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
	exit(42);
}
if (krb5_is_failure(krb5_gss_update_context())) {
	exit(42);
}
if (krb5_update_context_needs_more()) {
   session_key = krb5_gss_session_key();
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Update Context (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context.md`)

krb5_gss_update_context(3nasl)

NAME

krb5_gss_update_context - Updates the context with the provided data and caches the output for the application.

SYNOPSIS

int krb5_gss_update_context(str);

Has an optional positional argument that contains the byte array to send to the KDC.

DESCRIPTION

Initializes the security context with the provided data and caches the output for the application.

When the service is cifs the first call of krb5_gss_update_context must be without data.

As this method returns an error code the caller must get the data for the application via krb5_gss_update_context_out().

To verify if the process requires further step the caller must call krb5_gss_update_context_needs_more().

RETURN VALUE

Returns 0 on success otherwise it is an failure.

EXAMPLES

nasl
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
	exit(42);
}
result = krb5_gss_update_context();
if (krb5_is_failure(result)) {
	exit(42);
}
while (krb5_gss_update_context_needs_more()) {
	out = krb5_gss_update_context_out();
	soc = open_sock_tcp( 445 );
	if( ! soc ) {
	   exit(42);
	}
	send(socket:soc, data:out);
	rec = recv(socket: sock);
	if (!rec) {
		exit(42);
	} 
	result = krb5_gss_update_context(rec);
	if (krb5_is_failure(result)) {
		exit(42);
	}
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Update Context Needs More (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_needs_more.md`)

krb5_gss_update_context_needs_more(3nasl)

NAME

krb5_gss_update_context_needs_more - Returns true when the previous krb5_gss_update_context requires further information/calls.

SYNOPSIS

int krb5_gss_update_context_needs_more();

Returns 1 if the previous krb5_gss_update_context requires further information/calls, 0 otherwise.

DESCRIPTION

This method is used to verify if the previous krb5_gss_update_context requires further information/calls.

RETURN VALUE

Returns 1 if the previous krb5_gss_update_context requires further information/calls, 0 otherwise.

EXAMPLES

nasl
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
	exit(42);
}
result = krb5_gss_update_context();
if (krb5_is_failure(result)) {
	exit(42);
}
if (krb5_gss_update_context_needs_more()) {
	exit(0);	
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Gss Update Context Out (`doc/manual/nasl/built-in-functions/krb5/krb5_gss_update_context_out.md`)

krb5_gss_update_context_out(3nasl)

NAME

krb5_gss_update_context_out - Returns the data for the application to send to the service.

SYNOPSIS

str krb5_gss_update_context_out();

DESCRIPTION

This function is used to get the data that the application should send to the service.

It should be called after krb5_gss_update_context to may get data that should be sent to the service.

The caller must check if the result is not NULL before using it.

RETURN VALUE

Returns the data that should be sent to the service or NULL if there is no data to send.

EXAMPLES

nasl
login       = string( get_kb_item( "KRB5/login_filled/0" ) );
password    = string( get_kb_item( "KRB5/password_filled/0" ) );
realm = string( get_kb_item( "KRB5/realm_filled/0" ) );
kdc         = string( get_kb_item( "KRB5/kdc_filled/0" ) );
host        = ip_reverse_lookup(); # must be a domain name.

result = krb5_gss_prepare_context(realm: realm, kdc: kdc, host: host, service: 'cifs', user: login, password: passwod);
if (krb5_is_failure(result)) {
	exit(42);
}
result = krb5_gss_update_context();
if ((out = krb5_gss_update_context_out())) {
	soc = open_sock_tcp( 445 );
	if( ! soc ) {
	   exit(42);
	}
	send(socket:soc, data:out);
}

Doc Manual Nasl Built In Functions Krb5 Krb5 Is Failure (`doc/manual/nasl/built-in-functions/krb5/krb5_is_failure.md`)

krb5_is_failure(3nasl)

NAME

krb5_is_failure - Returns 1 if the last stored krb5 or given result code is a failure, 0 otherwise.

SYNOPSIS

int krb5_is_failure(0: int);

krb5_is_failure takes an optional positional argument.

DESCRIPTION

Checks if given result code or cached result code is a failure. If no result code is given, the last cached result code is used.

The cached result code reflects the error code of the last krb5 function call.

RETURN VALUE

Returns 1 if the result code is a failure, 0 otherwise.

EXAMPLES

c#
failure = krb5_is_failure();
display(failure);

Doc Manual Nasl Built In Functions Krb5 Krb5 Is Success (`doc/manual/nasl/built-in-functions/krb5/krb5_is_success.md`)

krb5_is_success(3nasl)

NAME

krb5_is_success - Returns 1 if the last stored krb5 or given result code is a success, 0 otherwise.

SYNOPSIS

int krb5_is_success(0: int);

krb5_is_success takes an optional positional argument.

DESCRIPTION

Checks if given result code or cached result code is a success. If no result code is given, the last cached result code is used.

The cached result code reflects the error code of the last krb5 function call.

RETURN VALUE

Returns 1 if the result code is a success, 0 otherwise.

EXAMPLES

c#
success = krb5_is_success();
display(success);

Doc Manual Nasl Built In Functions Misc Dec2str (`doc/manual/nasl/built-in-functions/misc/dec2str.md`)

dec2str(3nasl)

NAME

dec2str - converts given num as str

SYNOPSIS

str dec2str(num: int);

dec2str takes 1 named argument.

DESCRIPTION

Converts a given number num to string.

Returns

A string representation of the given number.

EXAMPLES

cpp
display(dec2str(num: 23));

Doc Manual Nasl Built In Functions Misc Defined Func (`doc/manual/nasl/built-in-functions/misc/defined_func.md`)

defined_func(3nasl)

NAME

defined_func - check if a given function is defined

SYNOPSIS

bool defined_func(0: string);

defined_func takes 1 positional argument.

DESCRIPTION

Returns true when given function name is defined as a function otherwise false.

RETURN VALUE

true when the function is defined otherwise false.

ERRORS

Returns NULL when given data is null.

EXAMPLES

cpp
if (defined_func("display"))
  display('defined');

Doc Manual Nasl Built In Functions Misc Dump Ctxt (`doc/manual/nasl/built-in-functions/misc/dump_ctxt.md`)

dump_ctxt(3nasl)

NAME

dump_ctxt - debug function to print the keys available within the called context

SYNOPSIS

nil dump_ctxt();

dump_ctxt takes no arguments.

DESCRIPTION

Is a debug function to print the keys available within the called context. It does not take any nor returns any arguments.

EXAMPLES

cpp
dump_ctxt();

Doc Manual Nasl Built In Functions Misc Exit (`doc/manual/nasl/built-in-functions/misc/exit.md`)

exit(3nasl)

NAME

exit - ends the script with the given result code

SYNOPSIS

void exit(0: int);

exit takes one positional argument.

DESCRIPTION

exit ends the script with the given result code.

EXAMPLES

cpp
exit(1);

Doc Manual Nasl Built In Functions Misc Get Byte Order (`doc/manual/nasl/built-in-functions/misc/get_byte_order.md`)

get_byte_order(3nasl)

NAME

get_byte_order - get byte order of host system

SYNOPSIS

bool get_byte_order();

get_byte_order takes no arguments

DESCRIPTION

Returns the byte order of the system. True when little-endian and false when big-endian.

Returns

1 when little-endian

0 when bid-endian

EXAMPLES

cpp
let le = get_byte_order();

Doc Manual Nasl Built In Functions Misc Gettimeofday (`doc/manual/nasl/built-in-functions/misc/gettimeofday.md`)

gettimeofday(3nasl)

NAME

gettimeofday - get the number of seconds and microseconds since 1970-01-01

SYNOPSIS

str gettimeofday();

gettimeofday takes no arguments

DESCRIPTION

Returns the seconds and microseconds counted from 1st January 1970. It formats a string containing the seconds separated by a . followed by the microseconds.

For example: “1067352015.030757” means 1067352015 seconds and 30757 microseconds.

RETURN VALUE

Returns the seconds and microseconds counted from 1st January 1970. It formats a string containing the seconds separated by a . followed by the microseconds.

For example: “1067352015.030757” means 1067352015 seconds and 30757 microseconds.

EXAMPLES

cpp
display(gettimeofday());

Doc Manual Nasl Built In Functions Misc Gunzip (`doc/manual/nasl/built-in-functions/misc/gunzip.md`)

gunzip(3nasl)

NAME

gunzip - decompress given data.

SYNOPSIS

str gunzip(data: str);

gunzip takes 1 named argument.

DESCRIPTION

Decompresses given data.

Returns

Decompressed data.

EXAMPLES

cpp
compressed = gunzip(gzip(data: "very large"));

Doc Manual Nasl Built In Functions Misc Gzip (`doc/manual/nasl/built-in-functions/misc/gzip.md`)

gzip(3nasl)

NAME

gzip - compress given data with gzip

SYNOPSIS

string gzip(string, headformat: string);

gzip takes 1 positional and 1 named argument.

DESCRIPTION

Compress given data with gzip, when headformat is set to 'gzip' it uses gzipheader.

Returns

Compressed data.

EXAMPLES

cpp
compressed = gzip("very large", headformat: "gzip");

SEE ALSO

gunzip(3nasl),

Doc Manual Nasl Built In Functions Misc Isnull (`doc/manual/nasl/built-in-functions/misc/isnull.md`)

isnull(3nasl)

NAME

isnull - check if a given value is NULL

SYNOPSIS

bool isnull(any);

isnull takes 1 positional argument.

DESCRIPTION

Returns true when the given unnamed argument is null.

Although semantically equal isnull behaves different than == NULL while

text
if (0 == NULL)
  display('0 == NULL');

yields true and prints 0 == NULL

text
if (isnull(0))
  display('0 == NULL');

yields false and does not print the message.

RETURN VALUE

Returns true when the given unnamed argument is null.

EXAMPLES

cpp
if (!isnull(0))
  display('0 != NULL');

Doc Manual Nasl Built In Functions Misc Keys (`doc/manual/nasl/built-in-functions/misc/keys.md`)

keys(3nasl)

NAME

keys - returns an array with the keys of a dict

SYNOPSIS

array keys(array);

keys takes 1 positional argument.

DESCRIPTION

Keys returns an array with the keys of a dict.
Memory for each key-value tuple is reserved separately and allocated memory do
not necessarily return contiguous memory addresses because of how dynamic
memory allocation works in C and how the operating system manages memory.
Therefore, key-value tuples do not necessarily keep the order in which
they were stored.

Returns

An array of used keys within a dict or NULL when the argument is not a dict/array.

EXAMPLES

cpp
a["test"] = 2;
a[1] = 3;

display(keys(a));

Doc Manual Nasl Built In Functions Misc Localtime (`doc/manual/nasl/built-in-functions/misc/localtime.md`)

localtime(3nasl)

NAME

localtime - returns an dict(mday, mon, min, wday, sec, yday, isdst, year, hour) based on optional given time in seconds and optional flag if utc or not.

SYNOPSIS

string localtime(any, utc: bool);

localtime takes 1 positional and 1 named argument.

DESCRIPTION

Takes an optional argument based on seconds from 1970-01-01 in either int or a string in the form of seconds.microseconds as well as an flag if the given Unix time is in utc or not.

If the arguments are omitted than it uses the current time of the machine.

RETURN VALUE

It returns a dictionary with the fields:

  • sec The number of seconds after the minute, normally in the range 0 to 59, but can be up to 61 to allow for leap seconds.
  • min The number of minutes after the hour, in the range 0 to 59.
  • hour The number of hours past midnight, in the range 0 to 23.
  • mday The day of the month, in the range 1 to 31.
  • mon The number of the month, in the range 1 to 12.
  • year The year (4 digits).
  • wday The number of days since Sunday, in the range 0 to 6.
  • yday The current day in the year, in the range 1 to 366.
  • isdst A flag that indicates whether daylight saving time is in effect at the time described.

EXAMPLES

cpp
display(localtime());

SEE ALSO

gettimeofday(3nasl),
mktime(3nasl),
unixtime(3nasl),

Doc Manual Nasl Built In Functions Misc Make Array (`doc/manual/nasl/built-in-functions/misc/make_array.md`)

make_array(3nasl)

NAME

make_array - takes any even number of unnamed arguments and returns an dictionary made from them

SYNOPSIS

dict make_array(any, any, ...);

make_array takes any even number of unnamed arguments and returns an dictionary made from them.

DESCRIPTION

Takes any even number of unnamed arguments and returns an dictionary made from them.
Each uneven argument will be the key while each even argument is the value.

Memory for each key-value tuple is reserved separately and allocated memory do not
necessarily return contiguous memory addresses because of how dynamic memory allocation
works in C and how the operating system manages memory. Therefore, key-value tuples
do not necessarily keep the order in which they were stored.

RETURN VALUE

Returns a dictionary made out of the arguments.

Error

Drops the last value when the arguments are not even.

EXAMPLES

cpp
a = make_array('a', 1, 2, 3);

SEE ALSO

make_list(3nasl),

Doc Manual Nasl Built In Functions Misc Make List (`doc/manual/nasl/built-in-functions/misc/make_list.md`)

make_list(3nasl)

NAME

make_list - takes any number of unnamed arguments and returns an array made from them.

SYNOPSIS

arr make_list(any, ...);

make_list takes any number of unnamed arguments and returns an array made from them.

DESCRIPTION

Takes any number of unnamed arguments and returns an array made from them.

It can also be used to flatten arrays.

Internally, make list realloc()ates memory, which guarantees that
the returned memory block is contiguous. Therefore, elements keep the
order in which they were stored.

RETURN VALUE

Returns an indexed array made out of the arguments. The index starts at 0.

EXAMPLES

cpp
arr = [0, 2, 3];
a = make_list('a', 1, arr);

SEE ALSO

make_array(3nasl),

Doc Manual Nasl Built In Functions Misc Mktime (`doc/manual/nasl/built-in-functions/misc/mktime.md`)

mktime(3nasl)

NAME

mktime - takes seven named arguments sec, min, hour, mday, mon, year, isdst and returns the Unix time.

SYNOPSIS

int mktime(arr|dict);

mktime takes seven named arguments sec, min, hour, mday, mon, year, isdst and returns the Unix time.

DESCRIPTION

Takes:

  • sec - seconds 0-60
  • min - minutes 0-60
  • hour - hour 0-23
  • mday - day of the month 0-31
  • mon - month 1-12
  • year - year four digits
  • isdst A flag that indicates whether daylight saving time is in effect at the time described.

Transforms those into the Unix time.

RETURN VALUE

Returns a Unix time (the number of seconds since 1970-01-01).

Error

Returns NULL when any given argument is invalid.

EXAMPLES

cpp
ut = mktime(sec: 10, min: 10, hour: 10, mday: 10, mon: 10, year: 2022, isdst: false);

SEE ALSO

gettimeofday(3nasl),
localtime(3nasl),
unixtime(3nasl),

Doc Manual Nasl Built In Functions Misc Rand (`doc/manual/nasl/built-in-functions/misc/rand.md`)

rand(3nasl)

NAME

rand - returns a pseudo random number.

SYNOPSIS

int rand();

rand returns a pseudo random number.

DESCRIPTION

Returns a pseudo random number.

Returns

A pseudo random number.

EXAMPLES

cpp
display(rand());

Doc Manual Nasl Built In Functions Misc Sleep (`doc/manual/nasl/built-in-functions/misc/sleep.md`)

sleep(3nasl)

NAME

sleep - takes an integer and sleeps the amount of seconds

SYNOPSIS

void sleep(int);

sleep takes an integer and sleeps the amount of seconds

DESCRIPTION

Sleeps the amount of given seconds.

EXAMPLES

cpp
sleep(1);

SEE ALSO

usleep(3nasl),

Doc Manual Nasl Built In Functions Misc Sort (`doc/manual/nasl/built-in-functions/misc/sort.md`)

sort(3nasl)

NAME

sort - sorts the value of a dict/array. WARNING: drops the keys of a dict and returns an array.

SYNOPSIS

arr sort(arr);

sort sorts the value of a dict/array. WARNING: drops the keys of a dict and returns an array.

DESCRIPTION

Sorts the values of an array in ascending order. When given a dict it will drop the keys and returns an indexed array instead.

So when given an dict:

text
a["test"] = 1;
a[1] = 0;
b = sort(a);

than b will be

text
[0: 0, 1: 1]

and the key test will be dropped.

Returns

An ascending sorted array.

EXAMPLES

cpp
a["test"] = 2;
a[1] = 3;

display(sort(a));

SEE ALSO

make_list(3nasl),

Doc Manual Nasl Built In Functions Misc Typeof (`doc/manual/nasl/built-in-functions/misc/typeof.md`)

typeof(3nasl)

NAME

typeof - returns the type of given unnamed argument.

SYNOPSIS

str typeof(any);

typeof returns the type of given unnamed argument.

DESCRIPTION

Returns the type of the given argument.

RETURN VALUE

Return

  • "undef" if the argument is not initialized,
  • "int" if the argument is an integer,
  • "string" if the argument is a string,
  • "data" if the argument is argument is string based on ''
  • "unknown" if the argument is of an unknown type

EXAMPLES

cpp
display(typeof('a'));

Doc Manual Nasl Built In Functions Misc Unixtime (`doc/manual/nasl/built-in-functions/misc/unixtime.md`)

unixtime(3nasl)

NAME

unixtime - returns the unix time (number of seconds since 1970-01-01).

SYNOPSIS

int unixtime();

unixtime returns the unix time (number of seconds since 1970-01-01).

DESCRIPTION

Returns the seconds counted from 1st January 1970 as an integer.

RETURN VALUE

Returns the seconds counted from 1st January 1970 as an integer.

EXAMPLES

cpp
display(unixtime());

SEE ALSO

gettimeofday(3nasl),
localtime(3nasl),
mktime(3nasl),

Doc Manual Nasl Built In Functions Misc Usleep (`doc/manual/nasl/built-in-functions/misc/usleep.md`)

usleep(3nasl)

NAME

usleep - takes an integer and sleeps the amount of microseconds

SYNOPSIS

void usleep(int);

usleep takes an integer and sleeps the amount of microseconds

DESCRIPTION

usleeps the amount of given microseconds.

EXAMPLES

cpp
usleep(1);

SEE ALSO

sleep(3nasl),

Doc Manual Nasl Built In Functions Network Functions Close (`doc/manual/nasl/built-in-functions/network-functions/close.md`)

close(3nasl)

NAME

close - closes the given socket.

SYNOPSIS

void close(FD);

close takes single unnamed argument, the socket file descriptor to be close.

DESCRIPTION

RETURN VALUE

Return FAKE_CELL, or Null on error

ERRORS

  • Invalid socket value

EXAMPLES

1: Open and close a socket

cpp
soc = open_sock_tcp(port);
close(soc);

SEE ALSO

open_sock_tcp(3nasl)

Doc Manual Nasl Built In Functions Network Functions End Denial (`doc/manual/nasl/built-in-functions/network-functions/end_denial.md`)

end_denial(3nasl)

NAME

end_denial - end denial

SYNOPSIS

bool end_denial();

end_denial takes no arguments.

DESCRIPTION

After calling start_denial before your test, it returns TRUE if the target host is still alive and FALSE if it is dead. start_denial(3nasl) must be called before.

RETURN VALUE

Returns TRUE if the target host is still alive and FALSE if it is dead.

SEE ALSO

start_denial(3nasl)

Doc Manual Nasl Built In Functions Network Functions Ftp Get Pasv Port (`doc/manual/nasl/built-in-functions/network-functions/ftp_get_pasv_port.md`)

ftp_get_pasv_port(3nasl)

NAME

ftp_get_pasv_port - sends the “PASV” command on the open socket, parses the returned data and returns the chosen “passive” port

SYNOPSIS

any ftp_get_pasv_port(socket:socket);

ftp_get_pasv_port It takes one named argument: socket.

DESCRIPTION

This function sends the “PASV” command on the open socket, parses the returned data and returns the chosen “passive” port.

RETURN VALUE

Return the passive port or Null

Doc Manual Nasl Built In Functions Network Functions Ftp Log In (`doc/manual/nasl/built-in-functions/network-functions/ftp_log_in.md`)

ftp_log_in(3nasl)

NAME

ftp_log_in - performs a FTP identification / authentication on an open socket

SYNOPSIS

any ftp_log_in(user: string, pass: string, socket: int);

ftp_log_in takes three named arguments:

  • user: is the user name (it has no default value like “anonymous” or “ftp”)
  • pass: is the password (again, no default value like the user e-mail address)
  • socket: an open socket.

DESCRIPTION

Performs a FTP identification / authentication on an open socket.

RETURN VALUE

Returns TRUE if it could login successfully, FALSE otherwise (e.g. wrong password, or any network problem).

ERRORS

  • Invalid socket value

EXAMPLES

1: Performs an ftp login.

cpp
soc = open_sock_tcp(23);
ftp_log_in(socket: soc, user: "foo", pass: "bar");

SEE ALSO

open_sock_tcp(3nasl)

Doc Manual Nasl Built In Functions Network Functions Get Host Ip (`doc/manual/nasl/built-in-functions/network-functions/get_host_ip.md`)

get_host_ip(3nasl)

NAME

get_host_ip - get the IP of the currently scanned host

SYNOPSIS

any get_host_ip();

get_host_ip takes no argument.

DESCRIPTION

Get the current host's ip

RETURN VALUE

Return a string containing the host ip, FAKE_CELL on failure.

Doc Manual Nasl Built In Functions Network Functions Get Host Open Port (`doc/manual/nasl/built-in-functions/network-functions/get_host_open_port.md`)

get_host_open_port(3nasl)

NAME

get_host_open_port - get an open TCP port on the target host

SYNOPSIS

any get_host_open_port();

get_host_open_port takes no arguments.

DESCRIPTION

This function is used by tests that need to speak to the TCP/IP stack but not to a specific service.
Don't always return the first open port, otherwise it might get bitten by OSes doing active SYN flood countermeasures. Also, avoid returning 80 and 21 as open ports, as many transparent proxies are acting for these.

RETURN VALUE

Return a random open port from a list (if there is many open ports), the port 21 or the port 80 are the last choices. Returns 0 if there is no open port.

Doc Manual Nasl Built In Functions Network Functions Get Mtu (`doc/manual/nasl/built-in-functions/network-functions/get_mtu.md`)

get_mtu(3nasl)

NAME

get_mtu - get the maximum transition unit for the scanned host

SYNOPSIS

int get_mtu();

get_mtu takes no arguments

DESCRIPTION

This function gets the maximum transition unit (MTU) for the currently scanned host.

RETURN VALUE

The MTU as int

ERRORS

Unable to get MTU of used interface

Doc Manual Nasl Built In Functions Network Functions Get Port State (`doc/manual/nasl/built-in-functions/network-functions/get_port_state.md`)

get_port_state(3nasl)

NAME

get_port_state - get a port state

SYNOPSIS

any get_port_state(int);

get_port_state takes one single unnamed argument, the port.

DESCRIPTION

As some TCP ports may be in an unknown state because they were not scanned, the behavior of this function may be modified by the “consider unscanned ports as closed” global option. When this option is reset (the default), get_port_state will return TRUE on unknown ports; when it is set, get_port_state will return FALSE.

RETURN VALUE

Returns TRUE if it is open and FALSE otherwise.

Doc Manual Nasl Built In Functions Network Functions Get Port Transport (`doc/manual/nasl/built-in-functions/network-functions/get_port_transport.md`)

get_port_transport(3nasl)

NAME

get_port_transport - Get the encapsulation used for the given port, if it was previously stored in the kb.

SYNOPSIS

any get_port_transport(int, asstring: bool);

get_port_transport takes an unnamed argument, the port number, and a named parameter asstring.

DESCRIPTION

Get the encapsulation used for the given port.

Currently, there are the following encapsulation types:

  • ENCAPS_AUTO = 0, Request auto detection.
  • ENCAPS_IP = 1, this is the “transport” value for a pure TCP socket.
  • ENCAPS_SSLv23 = 2, this is the “transport” value for a SSL connection in compatibility mode. Note that the find_service plugin will never declare a port with this "encapsulation", but you may use it in a script.
  • ENCAPS_SSLv2 = 3, The old SSL version which only supports server side certificates. By the way, there is only one plugin that really tries to destroy data. This is http_methods.nasl
  • ENCAPS_SSLv3 = 4, The new SSL version: it supports server and client side certificates, more ciphers, and fixes a few security holes.
  • ENCAPS_TLSv1 = 5, TLSv1 is defined RFC 2246. Some people call it “SSL v3.1”.
  • ENCAPS_TLSv11 = 6
  • ENCAPS_TLSv12 = 7
  • ENCAPS_TLSv13 = 8
  • ENCAPS_TLScustom = 9, SSL/TLS using custom priorities.
  • ENCAPS_MAX = 10

RETURN VALUE

Return the transport encapsulation mode (OPENVAS_ENCAPS_*) for the given PORT. If no such encapsulation mode has been stored in the knowledge base (or its value is < 0), OPENVAS_ENCAPS_IP is currently returned.
The return value depends on the parameters. An integer or a string with the encapsulation mode or NULL on error.

Doc Manual Nasl Built In Functions Network Functions Get Source Port (`doc/manual/nasl/built-in-functions/network-functions/get_source_port.md`)

get_source_port(3nasl)

NAME

get_source_port - get port of a opened socket

SYNOPSIS

int get_source_port(0: int);

socket_get_ssl_version takes one positional argument.

DESCRIPTION

This function gets the port information from a open socket connection. Its argument is:
0. an int representing the socket

RETURN VALUE

The port number of the socket connection or NULL on error.

ERRORS

  • missing argument
  • invalid socket
  • unable to get socket information

Doc Manual Nasl Built In Functions Network Functions Get Tcp Port State (`doc/manual/nasl/built-in-functions/network-functions/get_tcp_port_state.md`)

get_tcp_port_state(3nasl)

NAME

get_tcp_port_state - Get a port state

SYNOPSIS

any get_tcp_port_state(int);

get_tcp_port_state takes one single unnamed argument, the port.

DESCRIPTION

As some TCP ports may be in an unknown state because they were not scanned, the behavior of this function may be modified by the “consider unscanned ports as closed” global option. When this option is reset (the default), get_tcp_port_state will return TRUE on unknown ports; when it is set, get_tcp_port_state will return FALSE.
This function is the same as get_port_state(3nasl).

RETURN VALUE

Returns TRUE if it is open and FALSE otherwise.

SEE ALSO

get_port_state(3nasl)

Doc Manual Nasl Built In Functions Network Functions Get Udp Port State (`doc/manual/nasl/built-in-functions/network-functions/get_udp_port_state.md`)

get_udp_port_state(3nasl)

NAME

get_udp_port_state - get a udp port state.

SYNOPSIS

any get_udp_port_state(int);

get_udp_port_state takes one single unnamed argument, the port.

DESCRIPTION

As some TCP ports may be in an unknown state because they were not scanned, the behavior of this function may be modified by the “consider unscanned ports as closed” global option. When this option is reset (the default), get_udp_port_state will return TRUE on unknown ports; when it is set, get_udp_port_state will return FALSE.

Note that UDP port scanning may be unreliable.

RETURN VALUE

Returns TRUE if it is open and FALSE otherwise.

ERRORS

EXAMPLES

1: Get and display the state of the given port.

cpp
st = get_udp_port_state(port);
display(st);

SEE ALSO

display(3nasl)

Doc Manual Nasl Built In Functions Network Functions Islocalhost (`doc/manual/nasl/built-in-functions/network-functions/islocalhost.md`)

islocalhost(3nasl)

NAME

islocalhost - Check if the target host is the same as the attacking host

SYNOPSIS

any islocalhost();

islocalhost takes no arguments

DESCRIPTION

Check if the target host is the same as the attacking host
This tests is performed via a packet sent to IP and checking if it is LIKELY to be routed through the kernel localhost interface.

RETURN VALUE

Return True or False.

Doc Manual Nasl Built In Functions Network Functions Islocalnet (`doc/manual/nasl/built-in-functions/network-functions/islocalnet.md`)

islocalnet(3nasl)

NAME

islocalnet - Check if the target host is on the same network as the attacking host

SYNOPSIS

any islocalnet();

islocalnet takes no arguments

DESCRIPTION

Check if the target host is on the same network as the attacking host

RETURN VALUE

Return True or False.

Doc Manual Nasl Built In Functions Network Functions Join Multicast Group (`doc/manual/nasl/built-in-functions/network-functions/join_multicast_group.md`)

join_multicast_group(3nasl)

NAME

join_multicast_group - join a multicast group.

SYNOPSIS

any join_multicast_group(string);

join_multicast_group takes a single unnamed argument, an IP multicast address

DESCRIPTION

Join the multicast group given by the IP multicast address argument. If the group was already joined, the function joins increments an internal counter

RETURN VALUE

Return TRUE on success, Null on error.

ERRORS

  • Invalid parameter
  • Missing parameter
  • Socket error
  • Set socket error

Doc Manual Nasl Built In Functions Network Functions Leave Multicast Group (`doc/manual/nasl/built-in-functions/network-functions/leave_multicast_group.md`)

leave_multicast_group(3nasl)

NAME

leave_multicast_group - leaves a multicast group.

SYNOPSIS

any leave_multicast_group(string);

leave_multicast_group takes a single unnamed argument, an IP multicast address.

DESCRIPTION

Leaves a multicast group. Note that if join_multicast_group was called several times, each call to leave_multicast_cast only decrements a counter; the group is left when the counter reaches 0.

RETURN VALUE

Return FAKE_CELL, or NULL on error

ERRORS

  • Invalid parameter
  • Missing parameter
  • Never join to the group

EXAMPLES

1: Leave a multicast group

cpp
join_multicast_group("224.0.0.1");
join_multicast_group("224.0.0.1");
leave_multicast_group("224.0.0.1");
leave_multicast_group("224.0.0.1");

SEE ALSO

join_multicast_group(3nasl)

Doc Manual Nasl Built In Functions Network Functions Open Priv Sock Tcp (`doc/manual/nasl/built-in-functions/network-functions/open_priv_sock_tcp.md`)

open_priv_sock_tcp(3nasl)

NAME

open_priv_sock_tcp - opens a “privileged” TCP socket to the target host.

SYNOPSIS

any open_priv_sock_tcp(dport: int, sport: int, timeout: int);

open_priv_sock_tcp takes three named integer arguments:

  • dport is the destination port
  • sport is the source port, which may be inferior to 1024. This argument is optional.
    If it is not set, the function will try to open a socket on any port from 1 to 1023.
  • timeout: An integer with the timeout value in seconds. The default timeout is controlled by a global value.

DESCRIPTION

Open a “privileged” TCP socket to the target host.

RETURN VALUE

Return a socket, NULL on error.

ERRORS

  • Missing or undefined parameter dport
  • Get socket option error

EXAMPLES

1: Open and close a socket

cpp
soc = open_priv_sock_tcp(dport: 443, sport: 1000);
close(soc);

SEE ALSO

close(3nasl)

Doc Manual Nasl Built In Functions Network Functions Open Priv Sock Udp (`doc/manual/nasl/built-in-functions/network-functions/open_priv_sock_udp.md`)

open_priv_sock_udp(3nasl)

NAME

open_priv_sock_udp - opens a “privileged” UDP socket to the target host.

SYNOPSIS

any open_priv_sock_udp(dport: int, sport: int);

open_priv_sock_udp takes two named integer arguments:

  • dport is the destination port
  • sport is the source port, which may be inferior to 1024.

DESCRIPTION

Open a “privileged” UDP socket to the target host.

RETURN VALUE

Return a socket, NULL on error.

ERRORS

  • Missing or undefined parameter dport
  • Get socket option error

EXAMPLES

1: Open and close a socket

cpp
soc = open_priv_sock_udp(dport: 443, sport: 1000);
close(soc);

SEE ALSO

close(3nasl)

Doc Manual Nasl Built In Functions Network Functions Open Sock Kdc (`doc/manual/nasl/built-in-functions/network-functions/open_sock_kdc.md`)

open_sock_kdc(3nasl)

NAME

open_sock_kdc - open a kdc socket

SYNOPSIS

int open_sock_kdc();

open_sock_kdc takes no arguments.

DESCRIPTION

This function takes no arguments, but it is mandatory that keys are set. The following keys are required:

  • Secret/kdc_hostname
  • Secret/kdc_port
  • Secret/kdc_use_tcp

RETURN VALUE

An int representing the socket or NULL on error.

Error

  • any of the required keys is missing
  • unable to open socket

Doc Manual Nasl Built In Functions Network Functions Open Sock Tcp (`doc/manual/nasl/built-in-functions/network-functions/open_sock_tcp.md`)

open_sock_tcp(3nasl)

NAME

open_sock_tcp - opens a TCP socket to the target host.

SYNOPSIS

any open_sock_tcp(int, bufsz: int, timeout: int, transport: ENCPAPS, priority: string);

open_sock_tcp takes an unnamed integer argument (the port number) and four optional named arguments:

  • bufsz: An integer with the the size buffer size. Note that by default, no buffering is used.
  • timeout: An integer with the timeout value in seconds. The default timeout is controlled by a global value.
  • transport: One of the ENCAPS_* constants to force a specific encapsulation mode or force trying of all modes (ENCAPS_AUTO). This is for example useful to select a specific TLS or SSL version or use specific TLS connection setup priorities. See *get_port_transport for a description of the ENCAPS constants.
  • priority A string value with priorities for an TLS encapsulation. For the syntax of the priority string see the GNUTLS manual. This argument is only used in ENCAPS_TLScustom encapsulation.

DESCRIPTION

Open a TCP socket to the target host.
This function is used to create a TCP connection to the target host. It requires the port number as its argument and has various optional named arguments to control encapsulation, timeout and buffering.

RETURN VALUE

A positive integer as a NASL socket, 0 on connection error or NULL on other errors.

EXAMPLES

1: Open and close a socket

cpp
ftpPort= 21;

# Specifying the defaults plus ARCFOUR-128:
prior = "NORMAL:+ARCFOUR-128"

soc = open_sock_tcp(ftpPort, transport:get_port_transport(ftpPort), priority: prior);
close(soc);

SEE ALSO

close(3nasl)

Doc Manual Nasl Built In Functions Network Functions Open Sock Udp (`doc/manual/nasl/built-in-functions/network-functions/open_sock_udp.md`)

open_sock_udp(3nasl)

NAME

open_sock_udp - opens a UDP socket to the target host.

SYNOPSIS

any open_sock_udp(int);

open_sock_udp takes an unnamed integer argument (the port number)

DESCRIPTION

Open a UDP socket to the target host.

RETURN VALUE

A positive integer as a NASL socket, 0 on connection error or NULL on other errors.

EXAMPLES

1: Open and close a socket

cpp
soc = open_sock_udp(5060);
close(soc);

SEE ALSO

close(3nasl)

Doc Manual Nasl Built In Functions Network Functions Recv (`doc/manual/nasl/built-in-functions/network-functions/recv.md`)

recv(3nasl)

NAME

recv - receives data from a TCP or UDP socket.

SYNOPSIS

any recv(socket: int, length: int, min: int, timeout: int);

recv It takes at least two named arguments:

  • socket which was returned by open_sock_tcp, for example
  • length the number of bytes that you want to read at most. recv may return before length bytes have been read: as soon as at least one byte has been received, the timeout is lowered to 1 second. If no data is received during that time, the function returns the already read data; otherwise, if the full initial timeout has not been reached, a 1 second timeout is re-armed and the script tries to receive more data from the socket. This special feature was implemented to get a good compromise between reliability and speed when openvas-scanner talks to unknown or complex protocols. Two other optional named integer arguments can twist this behavior:
  • min is the minimum number of data that must be read in case the “magic read function” is activated and the timeout is lowered. By default this is 0. It works together with length. Note: when min is used, it is not possible to do multiple send and recv calls, as parts of the response of the first send might still be buffered. More info https://marc.info/?l=nessus-devel&m=102994743128944&w=2
  • timeout can be changed from the default.

DESCRIPTION

Receives data from a TCP or UDP socket. For a UDP socket, if it cannot read data, NASL will suppose that the last sent datagram was lost and will sent it again a couple of time.

RETURN VALUE

String with the received data or NULL on error.

EXAMPLES

1: Open a socket, receive data, close the socket and finally display the data.

cpp
soc = open_sock_tcp(port);
data = recv(socket: soc, length: 4096);
close(soc);
display(data);

SEE ALSO

close(3nasl), open_sock_tcp(3nasl), display(3nasl)

Doc Manual Nasl Built In Functions Network Functions Recv Line (`doc/manual/nasl/built-in-functions/network-functions/recv_line.md`)

recv_line(3nasl)

NAME

recv_line - receives data from a TCP or UDP socket.

SYNOPSIS

any recv_line(socket: int, length: int, timeout: int);

recv_line It takes at least two named arguments:

  • socket: which was returned by open_sock_tcp, for example
  • length: the number of bytes that you want to read at most.
  • timeout: can be changed from the default. Default: no timeout

DESCRIPTION

Receives data from a TCP or UDP socket and stops as soon as a line feed character has been read, length bytes have been read or the default timeout has been triggered.

RETURN VALUE

String with the received data or NULL on error.

ERRORS

  • missing or undefined parameter length or socket.

EXAMPLES

1: Open a socket, receive data, close the socket and finally display the data.

cpp
soc = open_sock_tcp(port);
data = recv_line(socket: soc, length: 4096, timeout: 10);
close(soc);
display(data);

SEE ALSO

close(3nasl), open_sock_tcp(3nasl), display(3nasl)

Doc Manual Nasl Built In Functions Network Functions Scanner Add Port (`doc/manual/nasl/built-in-functions/network-functions/scanner_add_port.md`)

scanner_add_port(3nasl)

NAME

scanner_add_port - declares an open port to openvas-scanner.

SYNOPSIS

void scanner_add_port(port: *int, proto: string);

scanner_add_port takes two named arguments:

  • port: is the port number.
  • proto: is "tcp" or "udp". This is optional and "tcp" is the default.

DESCRIPTION

Declares an open port to openvas-scanner.

RETURN VALUE

Return FAKE_CELL

ERRORS

  • Invalid socket value

Doc Manual Nasl Built In Functions Network Functions Scanner Get Port (`doc/manual/nasl/built-in-functions/network-functions/scanner_get_port.md`)

scanner_get_port(3nasl)

NAME

scanner_get_port - walks through the list of open ports

SYNOPSIS

any scanner_get_port(int);

scanner_get_port takes a single unnamed argument, the index.

DESCRIPTION

Walks through the list of open ports.
If the plugin is a port scanner, it needs to report the list of open ports back to openvas scanner, and it also needs to know which ports are to be scanned.

RETURN VALUE

Returns a port number or 0 when the end of the list if reached.

ERRORS

Index should be 0 the first time you call i

Doc Manual Nasl Built In Functions Network Functions Send (`doc/manual/nasl/built-in-functions/network-functions/send.md`)

send(3nasl)

NAME

send - sends data on a socket

SYNOPSIS

any send(socket: soc, data: string, length: int, option: int);

send takes the following named arguments:

  • socket: the socket, of course.
  • data: the data block. A string is expected here (pure or impure, this does not matter).
  • length: is optional and will be the full data length if not set
  • option: is the flags for the send() system call. You should not use a raw numeric value here.

DESCRIPTION

Send data on a socket.

RETURN VALUE

Return the amount of bytes sent on success. NULL on error.

ERRORS

  • Syntax error with the send() function with invalid socket or empty data.

EXAMPLES

1: Open and send data on socket.

cpp
data = "foo bar";
soc = open_sock_tcp(port);
n = send(socket:soc, data: data);

SEE ALSO

open_sock_tcp(3nasl)

Doc Manual Nasl Built In Functions Network Functions Start Denial (`doc/manual/nasl/built-in-functions/network-functions/start_denial.md`)

start_denial(3nasl)

NAME

start_denial - initializes some internal data structure for end_denial

SYNOPSIS

void start_denial();

start_denial takes no arguments.

DESCRIPTION

Initializes some internal data structure for end_denial(3nasl).

RETURN VALUE

None

SEE ALSO

end_denial(3nasl)

Doc Manual Nasl Built In Functions Network Functions Telnet Init (`doc/manual/nasl/built-in-functions/network-functions/telnet_init.md`)

telnet_init(3nasl)

NAME

telnet_init - performs a telnet negotiation on an open socket

SYNOPSIS

any telnet_init(int);

telnet_init This function takes one unnamed argument, the open socket.

DESCRIPTION

Read the data on the socket (more or less the telnet dialog plus the banner).

RETURN VALUE

Return FAKE_CELL, or Null on error

ERRORS

  • Invalid socket value

EXAMPLES

1: Open a socket and print the telnet banner.

cpp
soc = open_sock_tcp(21);
banner = telnet_init(soc);
display(banner);
close(soc);

SEE ALSO

close(3nasl), open_sock_tcp(3nasl), display(3nasl)

Doc Manual Nasl Built In Functions Network Functions This Host (`doc/manual/nasl/built-in-functions/network-functions/this_host.md`)

this_host(3nasl)

NAME

this_host - get the IP address of the current (attacking) machine

SYNOPSIS

any this_host();

this_host takes no arguments

DESCRIPTION

This function gets the IP address of the current (attacking) machine.

RETURN VALUE

The IP address of the host target as string.

Doc Manual Nasl Built In Functions Network Functions This Host Name (`doc/manual/nasl/built-in-functions/network-functions/this_host_name.md`)

this_host_name(3nasl)

NAME

this_host_name - get the host name of the current (attacking) machine

SYNOPSIS

any this_host_name();

this_host_name takes no arguments

DESCRIPTION

Get the host name of the current (attacking) machine.

RETURN VALUE

The host name

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Frame (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_frame.md`)

dump_frame(3nasl)

NAME

dump_frame - print a datalink layer frame

SYNOPSIS

void dump_frame(frame: string);

dump_frame takes one named argument

DESCRIPTION

Print a datalink layer frame in its hexadecimal representation.

The named argument frame is a string representing the datalink layer frame. A frame can be created with forge_frame(3nasl).

This function is meant to be used for debugging.

RETURN VALUE

None

SEE ALSO

forge_frame(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Icmp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_icmp_packet.md`)

dump_icmp_packet(3nasl)

NAME

dump_icmp_packet - prints ICMP IPv4 packets

SYNOPSIS

void dump_icmp_packet(data...);

dump_icmp_packet takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv4 ICMP packets and print them in a readable format in the screen.

A packet can be created with forge_icmp_packet(3nasl).

RETURN VALUE

None

EXAMPLES

1 Dump the forged icmp packet:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_TCP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

icmp_packet = forge_icmp_packet(icmp_code:  0,
                                icmp_type:  ICMP_MS_SYNC_REQ_TYPE,
                                icmp_seq:   0,
                                icmp_id:    ICMP_ID,
                                icmp_cksum: -1,
                                ip:         ip_packet);

dump_icmp_packet (icmp_packet);

SEE ALSO

forge_icmp_packet(3nasl), forge_ip_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Icmp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_icmp_v6_packet.md`)

dump_icmp_v6_packet(3nasl)

NAME

dump_icmp_v6_packet - prints the ICMP part of IPv6 datagrams

SYNOPSIS

void dump_icmp_v6_packet(data...);

dump_icmp_v6_packet takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv6 datagrams and print their ICMP part in a readable format in the screen.

A datagram can be created with forge_icmp_v6_packet(3nasl).

RETURN VALUE

None

SEE ALSO

forge_icmp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Ip Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_ip_packet.md`)

dump_ip_packet(3nasl)

NAME

dump_ip_packet - dumps IP datagrams.

SYNOPSIS

any dump_ip_packet(data...);

dump_ip_packet takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IP packets and print them in a readable format in the screen.

RETURN VALUE

None

EXAMPLES

1 :

cpp
ip_packet = forge_ip_packet(ip_hl:  5,
                            ip_v:   4,
                            ip_tos: 0,
                            ip_id:  rand(),
                            ip_off: IP_DF,
                            ip_ttl: 64,
                            ip_p:   IPPROTO_TCP,
                            ip_sum: 0,
                            ip_src: 192.168.0.1,
                            ip_dst: 192.168.0.12);

dump_ip_packet (ip_packet);

SEE ALSO

forge_ip_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Ip V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_ip_v6_packet.md`)

dump_ip_v6_packet(3nasl)

NAME

dump_ip_v6_packet - print IPv6 header

SYNOPSIS

NULL dump_ip_v6_packet(data...);

dump_ip_v6_packet takes any number of unnamed arguments.

DESCRIPTION

This function takes any number of IPv6 header and prints them in a readable format.

This function is exactly the same as dump_ipv6_packet(3nasl)

RETURN VALUE

None

SEE ALSO

dump_ipv6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Ipv6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_ipv6_packet.md`)

dump_ipv6_packet(3nasl)

NAME

dump_ipv6_packet - print IPv6 header

SYNOPSIS

NULL dump_ipv6_packet(data...);

dump_ipv6_packet takes any number of unnamed arguments.

DESCRIPTION

This function takes any number of IPv6 header and prints them in a readable format.

This function is exactly the same as dump_ip_v6_packet(3nasl)

RETURN VALUE

None

SEE ALSO

dump_ipv6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Tcp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_tcp_packet.md`)

dump_tcp_packet(3nasl)

NAME

dump_tcp_packet - print the TCP part of IPv4 datagrams

SYNOPSIS

NULL dump_tcp_packet(data...);

dump_tcp_packet It takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv4 datagrams and print their TCP part in a readable format in the screen.

RETURN VALUE

Return always NULL;

EXAMPLES

1 Dump the forged tcp packet:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_TCP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);


tcp_packet = forge_tcp_packet(ip:       ip_packet,
                              th_sport: 5080,
                              th_dport: 80,
                              th_seq:   1000,
                              th_ack:   0,
                              th_x2:    0,
                              th_off:   5,
                              th_flags: TH_SYN,
                              th_win:   0,
                              th_sum:   0,
                              th_urp:   0);

dump_tcp_packet (ip_packet);

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Tcp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_tcp_v6_packet.md`)

dump_tcp_v6_packet(3nasl)

NAME

dump_tcp_v6_packet - print the tcp part of IPv6 datagrams

SYNOPSIS

NULL dump_tcp_v6_packet(data...);

dump_tcp_v6_packet It takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv4 datagrams and print their TCP part in a readable format in the screen.

RETURN VALUE

None

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Udp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_udp_packet.md`)

dump_udp_packet(3nasl)

NAME

dump_udp_packet - print the UDP part of IPv4 datagrams

SYNOPSIS

any dump_udp_packet(data...);

dump_udp_packet It takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv4 datagrams and print their UDP part in a readable format in the screen.

RETURN VALUE

Return always NULL;

EXAMPLES

1 Dump the forged udp packet:

cpp
data = "some data";

UDP_LEN = strlen(blat) + 8;
ip = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_UDP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

udpip = forge_udp_packet(ip : ip,
                         uh_sport : 32000,
                         uh_dport : 5060,
                         uh_ulen : UDP_LEN,
                         data : data);

dump_udp_packet (udpip);

SEE ALSO

forge_ip_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Dump Udp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/dump_udp_v6_packet.md`)

dump_udp_v6_packet(3nasl)

NAME

dump_udp_v6_packet - print the UDP part of IPv6 datagrams

SYNOPSIS

NULL dump_udp_v6_packet(data...);

dump_udp_v6_packet It takes any number of unnamed arguments.

DESCRIPTION

Receive a list of IPv6 datagrams and print their UDP part in a readable format in the screen.

RETURN VALUE

None

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Frame (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_frame.md`)

forge_frame(3nasl)

NAME

forge_frame - forge a datalink layer frame

SYNOPSIS

string forge_frame(src_haddr: string, dst_haddr: string, ether_proto: int, payload: data);

forge_frame takes 4 named arguments.

DESCRIPTION

This function forges a datalink layer frame.

src_haddr: is a string containing the source MAC address

dst_haddr: is a string containing the destination MAC address

ether_proto: is an int containing the ethernet type (normally given as hexadecimal). It is optional and its default value is 0x0800.
A list of Types can be e.g. looked up here.

payload: is any data, which is then attached as payload to the frame.

RETURN VALUE

The forged frame as binary data.

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Icmp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_icmp_packet.md`)

forge_icmp_packet(3nasl)

NAME

forge_icmp_packet - fills an IP datagram with ICMP data.

SYNOPSIS

string forge_icmp_packet(icmp_code: int, icmp_type: ICMP_MS_SYNC_REQ_TYPE, icmp_seq: int, icmp_id: ICMP_ID, icmp_cksum: int, ip: string);

forge_icmp_packet It takes

DESCRIPTION

Fills an IP datagram with ICMP data. Note that the ip_p field is not updated. It returns the modified IP datagram. Its arguments are:

  • ip: IP datagram that is updated.
  • data: Payload.
  • icmp_cksum: Checksum, computed by default.
  • icmp_code: ICMP code. 0 by default.
  • icmp_id: ICMP ID. 0 by default.
  • icmp_seq: ICMP sequence number.
  • icmp_type: ICMP type. 0 by default.
  • update_ip_len: If this flag is set, NASL will recompute the size field of the IP datagram. Default: True.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • missing 'ip' parameter.

EXAMPLES

1 Forge the forged icmp packet:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_ICMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

icmp_packet = forge_icmp_packet(icmp_code:  0,
                                icmp_type:  ICMP_MS_SYNC_REQ_TYPE,
                                icmp_seq:   0,
                                icmp_id:    ICMP_ID,
                                icmp_cksum: -1,
                                ip:         ip_packet);

dump_icmp_packet (icmp_packet);

SEE ALSO

forge_ip_packet(3nasl), dump_icmp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Icmp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_icmp_v6_packet.md`)

forge_icmp_v6_packet(3nasl)

NAME

forge_icmp_v6_packet - fills an IPv6 datagram with ICMP data.

SYNOPSIS

string forge_icmp_v6_packet(ip6: string, data: string, icmp_type: int, icmp_code: int, icmp_id: int, icmp_seq: int, reachable_time: int, retransmit_timer: int, flags: int, target: string, update_ip_len: int, icmp_cksum: int);

forge_icmp_v6_packet It takes up to 10 named arguments.

DESCRIPTION

Fills an IPv6 datagram with ICMP data. Note that the ip_p field is not updated. It returns the modified IPv6 datagram. Its arguments are:

  • ip6: IPv6 datagram that is updated.
  • data: Payload.
  • icmp_type: ICMP type. 0 by default.
  • icmp_code: ICMP code. 0 by default.
  • icmp_id: ICMP ID. 0 by default.
  • icmp_seq: ICMP sequence number.
  • reachable_time: Configures the duration that a router considers a remote IPv6 node reachable. 0 by default.
  • transmit_timer: Configures the retransmit interval. The retransmit interval is the time between Link-State Advertisement (LSA) retransmissions to adjacent routers for a given interface. 0 by default.
  • update_ip_len: If this flag is set, NASL will recompute the size field of the IP datagram. Default: True.
  • icmp_cksum: Checksum, computed by default.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • missing 'ip' parameter.

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Igmp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_igmp_packet.md`)

forge_igmp_packet(3nasl)

NAME

forge_igmp_packet - fills an IP datagram with IGMP data.

SYNOPSIS

string forge_igmp_packet(ip: string, data: string, code: int, group: string, type: int, update_ip_len: bool);

forge_igmp_packet It takes named arguments.

DESCRIPTION

Fills an IP datagram with IGMP data. Note that the ip_p field is not updated. It returns the modified IP datagram. Its arguments are:

  • ip: IP datagram that is updated.
  • data: Payload.
  • code: IGMP code. 0 by default.
  • group: IGMP group
  • type: IGMP type. 0 by default.
  • update_ip_len: If this flag is set, NASL will recompute the size field of the IP datagram. Default: True.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • missing 'ip' parameter.

EXAMPLES

1 Forge the forged igmp packet:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);


igmp2 = forge_igmp_packet(ip    : ip_packet,
                          type  : 0x11,
                          code  : 0x00,
                          group : 0.0.0.0,
                          data  : "haha",
                          update_ip_len : FALSE);

SEE ALSO

forge_ip_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Igmp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_igmp_v6_packet.md`)

forge_igmp_v6_packet(3nasl)

NAME

forge_igmp_v6_packet - fills an IPv6 datagram with IGMP data.

SYNOPSIS

string forge_igmp_v6_packet(ip6: string, data: string, code: int, group: string, type: int, update_ip_len: bool);

forge_igmp_v6_packet It takes named arguments.

DESCRIPTION

Fills an IPv6 datagram with IGMP data. Note that the ip_p field is not updated. It returns the modified IPv6 datagram. Its arguments are:

  • ip6: IPv6 datagram that is updated.
  • data: Payload.
  • code: IGMP code. 0 by default.
  • group: IGMP group
  • type: IGMP type. 0 by default.
  • update_ip_len: If this flag is set, NASL will recompute the size field of the IP datagram. Default: True.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • missing 'ip' parameter.

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Ip Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_ip_packet.md`)

forge_ip_packet(3nasl)

NAME

forge_ip_packet - Forge an IP datagram inside the block of data

SYNOPSIS

string forge_ip_packet(data: string, ip_hl: int, ip_id: int, ip_len: int, ip_off: int, ip_p: IPPROTO, ip_dst: string ,ip_src: string, ip_sum: int, ip_tos: int, ip_ttl: int, ip_v is: **);

forge_ip_packet It takes named arguments.

DESCRIPTION

Forge an IP datagram inside the block of data. It takes following arguments:

  • data: is the payload.
  • ip_hl: is the IP header length in 32 bits words. 5 by default.
  • ip_id: is the datagram ID; by default, it is random.
  • ip_len: is the length of the datagram. By default, it is 20 plus the length of the data field.
  • ip_off: is the fragment offset in 64 bits words. By default, 0.
  • ip_p: is the IP protocol. 0 by default.
  • ip_src: is the source address in ASCII. NASL will convert it into an integer in network order.
  • ip_dst: is the destination address in ASCII. NASL will convert it into an integer in network order. By default it takes the target IP address via call to get_host_ip(3nasl). This option looks dangerous, but since anybody can edit an IP packet with the string functions, we make it possible to set directly during the forge.
  • ip_sum: is the packet header checksum. It will be computed by default.
  • ip_tos: is the “type of service” field. 0 by default
  • ip_ttl: is the “Time To Live”. 64 by default.
  • ip_v is: the IP version. 4 by default.

RETURN VALUE

The IP datagram or NULL on error.

ERRORS

EXAMPLES

1 Forge the forged ip packet for later fill it with IGMP paget:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);


igmp2 = forge_igmp_packet(ip    : ip_packet,
                          type  : 0x11,
                          code  : 0x00,
                          group : 0.0.0.0,
                          data  : "haha",
                          update_ip_len : FALSE);

SEE ALSO

forge_igmp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Ip V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_ip_v6_packet.md`)

forge_ip_v6_packet(3nasl)

NAME

forge_ip_v6_packet - forge an IPv6 datagram inside the block of data

SYNOPSIS

string forge_ip_v6_packet(data: string, ip6_v: int, ip6_tc: int, ip6_fl: int, ip6_p: int, ip6_hlim: int, ip6_src: string, ip6_dst: string);

forge_ip_v6_packet It takes named arguments.

DESCRIPTION

Forge an IPv6 datagram inside the block of data. It takes following arguments:

  • data: is the payload.
  • ip6_v: version, 6 by default.
  • ip6_tc: Traffic class. 0 by default.
  • ip6_fl: Flow label. 0 by default.
  • ip_p: is the IP protocol. 0 by default.
  • ip6_hlim: Hop limit. Max. 255. 64 by default.
  • ip6_src: is the source address in ASCII. NASL will convert it into an integer in network order.
  • ip6_dst: is the destination address in ASCII. NASL will convert it into an integer in network order. By default it takes the target IP address via call to get_host_ip(3nasl). This option looks dangerous, but since anybody can edit an IP packet with the string functions, we make it possible to set directly during the forge.

RETURN VALUE

The IP datagram or NULL on error.

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Ipv6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_ipv6_packet.md`)

forge_ipv6_packet(3nasl)

NAME

forge_ipv6_packet - Forge an IPv6 datagram inside the block of data, same as forge_ip_v6_packet

SYNOPSIS

string forge_ipv6_packet(data: string, ip6_v: int, ip6_tc: int, ip6_fl: int, ip6_p: int, ip6_hlim: int, ip6_src: string, ip6_dst: string);

forge_ipv6_packet takes named arguments

DESCRIPTION

For more details see forge_ip_v6_packet(3nasl).

SEE ALSO

forge_ip_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Tcp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_tcp_packet.md`)

forge_tcp_packet(3nasl)

NAME

forge_tcp_packet - Fills an IP datagram with TCP data.

SYNOPSIS

string forge_tcp_packet(data: string, ip: string, th_ack: int, th_dport: int, th_flags: TCP_HEADER_FLAG, th_off: int, th_seq: int, th_sport: int, th_sum: int, th_urp: int, th_win: int, th_x2: int, update_ip_len: int);

forge_tcp_packet It takes many named arguments, someones are optionals. For details, seethe description below.

DESCRIPTION

Fills an IP datagram with TCP data. Note that the ip_p field is not updated. It returns the modified IP datagram. Its arguments are:

  • data: is the TCP data payload.
  • ip: is the IP datagram to be filled.
  • th_ack: is the acknowledge number. NASL will convert it into network order if necessary. 0 by default.
  • th_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • th_flags: are the TCP flags. 0 by default.
  • th_off: is the size of the TCP header in 32 bits words. By default, 5.
  • th_seq: is the TCP sequence number. NASL will convert it into network order if necessary. Random by default.
  • th_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • th_sum: is the TCP checksum. By default, the right value is computed.
  • th_urp: is the urgent pointer. 0 by default.
  • th_win: is the TCP window size. NASL will convert it into network order if necessary. 0 by default.
  • th_x2: is a reserved field and should probably be left unchanged. 0 by default.
  • update_ip_len: is a flag (TRUE by default). If set, NASL will recompute the size field of the IP datagram.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • You must supply the ip argument: You get this error if you don't provide the named argument ip.

EXAMPLES

1 Dump the forged tcp packet:

cpp
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_TCP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);


tcp_packet = forge_tcp_packet(ip:       ip_packet,
                              th_sport: 5080,
                              th_dport: 80,
                              th_seq:   1000,
                              th_ack:   0,
                              th_x2:    0,
                              th_off:   5,
                              th_flags: TH_SYN,
                              th_win:   0,
                              th_sum:   0,
                              th_urp:   0);

dump_tcp_packet (ip_packet);

SEE ALSO

forge_ip_packet(3nasl), dump_tcp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Tcp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_tcp_v6_packet.md`)

forge_tcp_v6_packet(3nasl)

NAME

forge_tcp_v6_packet - Fills an IPv6 datagram with TCP data.

SYNOPSIS

string forge_tcp_v6_packet(ip6: string, data: string, th_sport: int, th_dport: int, th_ack: int, th_x2: int, th_off: int, th_flags: int, th_seq: int, th_win: int, th_sum: int, th_urp: int);

forge_tcp_v6_packet It takes many named arguments, someones are optionals. For details, seethe description below.

DESCRIPTION

Fills an IPv6 datagram with TCP data. Note that the ip_p field is not updated. It returns the modified IPv6 datagram. Its arguments are:

  • ip: is the IP datagram to be filled.
  • data: is the TCP data payload.
  • th_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • th_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • th_ack: is the acknowledge number. NASL will convert it into network order if necessary. 0 by default.
  • th_x2: is a reserved field and should probably be left unchanged. 0 by default.
  • th_off: is the size of the TCP header in 32 bits words. By default, 5.
  • th_flags: are the TCP flags. 0 by default.
  • th_seq: is the TCP sequence number. NASL will convert it into network order if necessary. Random by default.
  • th_win: is the TCP window size. NASL will convert it into network order if necessary. 0 by default.
  • th_sum: is the TCP checksum. By default, the right value is computed.
  • th_urp: is the urgent pointer. 0 by default.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • You must supply the ip6 argument: You get this error if you don't provide the named argument ip.

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Udp Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_udp_packet.md`)

forge_udp_packet(3nasl)

NAME

forge_udp_packet - Fills an IP datagram with UDP data.

SYNOPSIS

string forge_udp_packet(data: string, ip: string, uh_dport: int, uh_sport: int, uh_sum: int, uh_ulen: int, update_ip_len: int);

forge_udp_packet It takes many named arguments, someones are optional. For details, see the description below.

DESCRIPTION

Fills an IP datagram with UDP data. Note that the ip_p field is not updated. It returns the modified IP datagram. Its arguments are:

  • data: is the payload.
  • ip: is the IP datagram to be filled.
  • uh_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sum: is the UDP checksum. Although it is not compulsory, the right value is computed by default.
  • uh_ulen: is the data length. By default it is set to the length the data argument plus the size of the UDP header.
  • update_ip_len: is a flag (TRUE by default). If set, NASL will recompute the size field of the IP datagram.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • You must supply the ip6 argument: You get this error if you don't provide the named argument ip.

EXAMPLES

1 Dump the forged udp packet:

cpp
data = "some data";

UDP_LEN = strlen(blat) + 8;
ip = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_UDP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

udpip = forge_udp_packet(ip : ip,
                         uh_sport : 32000,
                         uh_dport : 5060,
                         uh_ulen : UDP_LEN,
                         data : data);

dump_udp_packet (udpip);

SEE ALSO

forge_ip_packet(3nasl), dump_udp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Forge Udp V6 Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/forge_udp_v6_packet.md`)

forge_udp_v6_packet(3nasl)

NAME

forge_udp_v6_packet - Fills an IPv6 datagram with UDP data.

SYNOPSIS

string forge_udp_v6_packet(ip6: string, data: string, uh_sport: int, uh_dport: int, uh_sum: int, uh_ulen: int, update_ip_len: int);

forge_udp_v6_packet It takes many named arguments, someones are optional. For details, see the description below.

DESCRIPTION

Fills an IPv6 datagram with UDP data. Note that the ip_p field is not updated. It returns the modified IP datagram. Its arguments are:

  • ip6: is the IPv6 datagram to be filled.
  • data: is the payload.
  • uh_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • uh_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sum: is the UDP checksum. Although it is not compulsory, the right value is computed by default.
  • uh_ulen: is the data length. By default it is set to the length the data argument plus the size of the UDP header.
  • update_ip_len: is a flag (TRUE by default). If set, NASL will recompute the size field of the IP datagram.

RETURN VALUE

The modified IP datagram or NULL on error.

ERRORS

  • You must supply the ip6 argument: You get this error if you don't provide the named argument ip.

Doc Manual Nasl Built In Functions Raw Ip Functions Get Icmp Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_icmp_element.md`)

get_icmp_element(3nasl)

NAME

get_icmp_element - Get an ICMP element from a IP datagram.

SYNOPSIS

int get_icmp_element(icmp: string, element: string);

get_icmp_element It takes two named.

DESCRIPTION

Get an ICMP element from a IP datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • icmp: is the IP datagram (not the ICMP part only).
  • element: is the name of the field to get

Valid ICMP elements to get are:

  • icmp_id
  • icmp_code
  • icmp_type
  • icmp_seq
  • icmp_chsum
  • icmp_data

RETURN VALUE

Returns an ICMP element from a IP datagram.

ERRORS

  • Missing icmp parameter.
  • Missing element parameter.
  • Element is not a valid element to get.

EXAMPLES

1 Dump the forged udp packet:

cpp
data = "some data";

UDP_LEN = strlen(blat) + 8;
ip = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_UDP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

udpip = get_icmp_element(ip : ip,
                         uh_sport : 32000,
                         uh_dport : 5060,
                         uh_ulen : UDP_LEN,
                         data : data);

dump_udp_packet (udpip);

SEE ALSO

forge_ip_packet(3nasl), dump_udp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Icmp V6 Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_icmp_v6_element.md`)

get_icmp_v6_element(3nasl)

NAME

get_icmp_v6_element - Get an ICMP element from a IPv6 datagram.

SYNOPSIS

int get_icmp_v6_element(icmp: string, element: string);

get_icmp_v6_element It takes two named.

DESCRIPTION

Get an ICMP element from a IPv6 datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • icmp: is the IPv6 datagram (not the ICMP part only).
  • element: is the name of the field to get

Valid ICMP elements to get are:

  • icmp_id
  • icmp_code
  • icmp_type
  • icmp_seq
  • icmp_chsum
  • icmp_data

RETURN VALUE

Returns an ICMP element from a IP datagram.

ERRORS

  • Missing 'icmp' parameter.
  • Missing 'element' parameter.
  • Element is not a valid element to get.

Doc Manual Nasl Built In Functions Raw Ip Functions Get Ip Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_ip_element.md`)

get_ip_element(3nasl)

NAME

get_ip_element - extracts a field from a IP datagram.

SYNOPSIS

int get_ip_element(ip: string, element: string);

get_ip_element It takes two named parameters.

DESCRIPTION

Get an ICMP element from a IP datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • ip: is the IP datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • ip_v
  • ip_id
  • ip_hl
  • ip_tos
  • ip_len
  • ip_off
  • ip_ttl
  • ip_p
  • ip_sum
  • ip_src
  • ip_dst

For more information look into forge_ip_packet

RETURN VALUE

Returns an IP element from a IP datagram.

ERRORS

  • no valid 'ip' argument
  • no valid 'element' argument
  • unknown element

SEE ALSO

forge_ip_packet

Doc Manual Nasl Built In Functions Raw Ip Functions Get Ip V6 Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_ip_v6_element.md`)

get_ip_v6_element(3nasl)

NAME

get_ip_v6_element - extracts a field from a IPv6 datagram.

SYNOPSIS

int get_ip_v6_element(ip6: string, element: string);

get_ip_v6_element It takes two named parameters.

DESCRIPTION

Same as get_ipv6_element(3nasl).

Get an ICMP element from a IPv6 datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • ip: is the IPv6 datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • ip6_v
  • ip6_tc
  • ip6_fl
  • ip6_plen
  • ip6_nxt
  • ip6_hlim
  • ip6_src
  • ip6_dst

For more information of these fields look into forge_ip_v6_packet(3nasl).

RETURN VALUE

Returns an IP element from a IPv6 datagram.

ERRORS

  • no valid 'ip' argument
  • no valid 'element' argument
  • unknown element

SEE ALSO

forge_ip_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Ipv6 Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_ipv6_element.md`)

get_ipv6_element(3nasl)

NAME

get_ipv6_element - extracts a field from a IPv6 datagram.

SYNOPSIS

int get_ipv6_element(ip6: string, element: string);

get_ipv6_element It takes two named parameters.

DESCRIPTION

Same as get_ip_v6_element(3nasl).

Get an ICMP element from a IPv6 datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • ip: is the IPv6 datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • ip6_v
  • ip6_tc
  • ip6_fl
  • ip6_plen
  • ip6_nxt
  • ip6_hlim
  • ip6_src
  • ip6_dst

For more information of these fields look into forge_ip_v6_packet(3nasl).

RETURN VALUE

Returns an IP element from a IPv6 datagram.

ERRORS

  • no valid 'ip' argument
  • no valid 'element' argument
  • unknown element

SEE ALSO

forge_ip_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Local Mac Address From Ip (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_local_mac_address_from_ip.md`)

get_local_mac_address_from_ip(3nasl)

NAME

get_local_mac_address_from_ip - get the MAC address of host

SYNOPSIS

string get_local_mac_address_from_ip(0: string);

get_local_mac_address_from_ip takes one unnamed argument.

DESCRIPTION

Get the MAC address of a local IP address.

The first positional argument is a local IP address as string.

RETURN VALUE

The resolved local MAC address corresponding to the given IP or NULL on error.

ERRORS

  • Invalid IP
  • Not a local IP
  • IP does not resolve do a MAC

Doc Manual Nasl Built In Functions Raw Ip Functions Get Tcp Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_tcp_element.md`)

get_tcp_element(3nasl)

NAME

get_tcp_element - extract TCP field from an IP datagram

SYNOPSIS

any get_tcp_element(tcp: string, element: string);

get_tcp_element takes 2 named arguments.

DESCRIPTION

Get an TCP element from a IP datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • tcp: is the IP datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • th_sport
  • th_dsport
  • th_seq
  • th_ack
  • th_x2
  • th_off
  • th_flags
  • th_win
  • th_sum
  • th_urp
  • data

For more information of these fields look into forge_tcp_packet(3nasl).

RETURN VALUE

Returns an TCP element from a IP datagram.

ERRORS

  • no valid tcp argument
  • no valid element argument
  • unknown element

SEE ALSO

forge_tcp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Tcp Option (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_tcp_option.md`)

get_tcp_option(3nasl)

NAME

get_tcp_option - get a TCP option from an IP datagram if present

SYNOPSIS

any get_tcp_option(tcp: string, option: int);

get_tcp_option takes 2 named arguments.

DESCRIPTION

Get a TCP option from a IP datagram. Its arguments are:

  • tcp: is the IP datagram.
  • option: is the name of the field to get

Valid IP options to get are:

  • 2: TCPOPT_MAXSEG, values between 536 and 65535
  • 3: TCPOPT_WINDOW, with values between 0 and 14
  • 4: TCPOPT_SACK_PERMITTED, no value required.
  • 8: TCPOPT_TIMESTAMP, 8 bytes value for timestamp and echo timestamp, 4 bytes each one.

RETURN VALUE

The returned option depends on the given option parameter. It is either an int for option 2, 3 and 4 or an array containing the two values for option 8.

Doc Manual Nasl Built In Functions Raw Ip Functions Get Tcp V6 Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_tcp_v6_element.md`)

get_tcp_v6_element(3nasl)

NAME

get_tcp_v6_element - extract TCP field from an IPv6 datagram

SYNOPSIS

any get_tcp_v6_element(tcp: string, element: string);

get_tcp_v6_element takes 2 named arguments.

DESCRIPTION

Get an TCP element from a IPv6 datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • tcp: is the IP datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • th_sport
  • th_dsport
  • th_seq
  • th_ack
  • th_x2
  • th_off
  • th_flags
  • th_win
  • th_sum
  • th_urp
  • data

For more information of these fields look into forge_tcp_v6_packet(3nasl).

RETURN VALUE

Returns an IP element from a IPv6 datagram.

ERRORS

  • no valid tcp argument
  • no valid element argument
  • unknown element

SEE ALSO

forge_tcp_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Tcp V6 Option (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_tcp_v6_option.md`)

get_tcp_v6_option(3nasl)

NAME

get_tcp_v6_option - get a TCP option from an IPv6 datagram if present

SYNOPSIS

any get_tcp_v6_option(tcp: string, option: int);

get_tcp_v6_option takes 2 named arguments.

DESCRIPTION

Get a TCP option from a IPv6 datagram. Its arguments are:

  • tcp: is the IP datagram.
  • option: is the name of the field to get

Valid IP options to get are:

  • 2: TCPOPT_MAXSEG, values between 536 and 65535
  • 3: TCPOPT_WINDOW, with values between 0 and 14
  • 4: TCPOPT_SACK_PERMITTED, no value required.
  • 8: TCPOPT_TIMESTAMP, 8 bytes value for timestamp and echo timestamp, 4 bytes each one.

RETURN VALUE

The returned option depends on the given option parameter. It is either an int for option 2, 3 and 4 or an array containing the two values for option 8.

Doc Manual Nasl Built In Functions Raw Ip Functions Get Udp Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_udp_element.md`)

get_udp_element(3nasl)

NAME

get_udp_element - extract UDP field from an IP datagram

SYNOPSIS

any get_udp_element(udp: string, element: string);

get_udp_element takes 2 named arguments.

DESCRIPTION

Get an UDP element from a IP datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • udp: is the IP datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • uh_sport
  • uh_dport
  • uh_ulen
  • uh_sum
  • data

For more information of these fields look into forge_udp_packet(3nasl).

RETURN VALUE

Returns an UDP element from a IP datagram.

ERRORS

  • no valid udp argument
  • no valid element argument
  • unknown element

SEE ALSO

forge_udp_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Get Udp V6 Element (`doc/manual/nasl/built-in-functions/raw-ip-functions/get_udp_v6_element.md`)

get_udp_v6_element(3nasl)

NAME

get_udp_v6_element - extract UDP field from an IPv6 datagram

SYNOPSIS

any get_udp_v6_element(udp: string, element: string);

get_udp_v6_element takes 2 named arguments.

DESCRIPTION

Get an UDP element from a IPv6 datagram. It returns a data block or an integer, according to the type of the element. Its arguments are:

  • udp: is the IP datagram.
  • element: is the name of the field to get

Valid IP elements to get are:

  • uh_sport
  • uh_dport
  • uh_ulen
  • uh_sum
  • data

For more information of these fields look into forge_udp_v6_packet(3nasl).

RETURN VALUE

Returns an UDP element from a IPv6 datagram.

ERRORS

  • no valid udp argument
  • no valid element argument
  • unknown element

SEE ALSO

forge_udp_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Insert Ip Options (`doc/manual/nasl/built-in-functions/raw-ip-functions/insert_ip_options.md`)

insert_ip_options(3nasl)

NAME

insert_ip_options - Add a option to a IP datagram

SYNOPSIS

string insert_ip_options(ip: string, code: int, length: int, value: string);

insert_ip_options takes 4 named arguments

DESCRIPTION

Add a option to a specified IP datagram.

  • ip: is the IP datagram
  • code: is the identifier of the option to add
  • length: is the length of the option data
  • value: is the option data

RETURN VALUE

A new IP datagram with the given option set.

Doc Manual Nasl Built In Functions Raw Ip Functions Insert Ip V6 Options (`doc/manual/nasl/built-in-functions/raw-ip-functions/insert_ip_v6_options.md`)

insert_ip_v6_options(3nasl)

NAME

insert_ip_v6_options - Add a option to a IPv6 datagram

SYNOPSIS

string insert_ip_v6_options(ip6: string, code: int, length: int, value: string);

insert_ip_v6_options takes 4 named arguments

DESCRIPTION

Add a option to a specified IPv6 datagram. This function is the same as insert_ipv6_options(3nasl).

  • ip: is the IP datagram
  • code: is the identifier of the option to add
  • length: is the length of the option data
  • value: is the option data

RETURN VALUE

A new IPv6 datagram with the given option set.

SEE ALSO

insert_ipv6_options(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Insert Ipv6 Options (`doc/manual/nasl/built-in-functions/raw-ip-functions/insert_ipv6_options.md`)

insert_ipv6_options(3nasl)

NAME

insert_ipv6_options - Add a option to a IPv6 datagram

SYNOPSIS

string insert_ipv6_options(ip6: string, code: int, length: int, value: string);

insert_ipv6_options takes 4 named arguments

DESCRIPTION

Add a option to a specified IPv6 datagram. This function is the same as insert_ip_v6_options(3nasl).

  • ip: is the IP datagram
  • code: is the identifier of the option to add
  • length: is the length of the option data
  • value: is the option data

RETURN VALUE

A new IPv6 datagram with the given option set.

SEE ALSO

insert_ip_v6_options(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Insert Tcp Options (`doc/manual/nasl/built-in-functions/raw-ip-functions/insert_tcp_options.md`)

insert_tcp_options(3nasl)

NAME

insert_tcp_options - insert TCP options to an IP datagram

SYNOPSIS

string insert_tcp_options(tcp: string, int...);

insert_tcp_options takes 1 named and any number of positional arguments

DESCRIPTION

This function adds TCP options to a IP datagram. The options are given as key value(s) pair with the positional argument list. The first positional argument is the identifier of the option, the next positional argument is the value for the option. For the option TCPOPT_TIMESTAMP (8) two values must be given.

Available options are:

  • 2: TCPOPT_MAXSEG, values between 536 and 65535
  • 3: TCPOPT_WINDOW, with values between 0 and 14
  • 4: TCPOPT_SACK_PERMITTED, no value required.
  • 8: TCPOPT_TIMESTAMP, 8 bytes value for timestamp and echo timestamp, 4 bytes each one.

RETURN VALUE

The modified datagram

EXAMPLES

1: insert a single option:

c#
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

ip_packet = insert_tcp_options(tcp: ip_packet, 2, 1234);

2: insert a multiple options with TCPOPT_TIMESTAMP:

c#
ip_packet = forge_ip_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

# The first value modifies the option TCPOPT_MAXSEG and has 1 value: 1234
# The second value modifies the option TCPOPT_TIMESTAMP and has 2 values: 20 and 25
ip_packet = insert_tcp_options(tcp: ip_packet, 2, 1234, 8, 20, 25);

SEE ALSO

forge_ip_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Insert Tcp V6 Options (`doc/manual/nasl/built-in-functions/raw-ip-functions/insert_tcp_v6_options.md`)

insert_tcp_v6_options(3nasl)

NAME

insert_tcp_v6_options - insert TCP options to an IPv6 datagram

SYNOPSIS

string insert_tcp_v6_options(tcp: string, int...);

insert_tcp_v6_options takes 1 named and any number of positional arguments

DESCRIPTION

This function adds TCP options to a IPv6 datagram. The options are given as key value(s) pair with the positional argument list. The first positional argument is the identifier of the option, the next positional argument is the value for the option. For the option TCPOPT_TIMESTAMP (8) two values must be given.

Available options are:

  • 2: TCPOPT_MAXSEG, values between 536 and 65535
  • 3: TCPOPT_WINDOW, with values between 0 and 14
  • 4: TCPOPT_SACK_PERMITTED, no value required.
  • 8: TCPOPT_TIMESTAMP, 8 bytes value for timestamp and echo timestamp, 4 bytes each one.

RETURN VALUE

The modified datagram

EXAMPLES

1: insert a single option:

c#
ip_packet = forge_ip_v6_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

ip_packet = insert_tcp_v6_options(tcp: ip_packet, 2, 1234);

2: insert a multiple options with TCPOPT_TIMESTAMP:

c#
ip_packet = forge_ip_v6_packet(ip_v : 4,
                     ip_hl : 5,
                     ip_tos : 0,
                     ip_len : 20,
                     ip_id : 0xFEAF,
                     ip_p : IPPROTO_IGMP,
                     ip_ttl : 255,
                     ip_off : 0,
                     ip_src : 192.168.0.1,
                     ip_dst : 192.168.0.12);

# The first value modifies the option TCPOPT_MAXSEG and has 1 value: 1234
# The second value modifies the option TCPOPT_TIMESTAMP and has 2 values: 20 and 25
ip_packet = insert_tcp_v6_options(tcp: ip_packet, 2, 1234, 8, 20, 25);

SEE ALSO

forge_ip_v6_packet(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Pcap Next (`doc/manual/nasl/built-in-functions/raw-ip-functions/pcap_next.md`)

pcap_next(3nasl)

NAME

pcap_next - read the next packet

SYNOPSIS

string pcap_next(interface: string, pcap_filter: string, timeout: int);

pcap_next takes 3 named arguments.

DESCRIPTION

This function is the same as send_capture(3nasl).

  • interface: network interface name, by default NASL will try to find the best one
  • pcap_filter: BPF filter, by default it listens to everything
  • timeout: timeout in seconds, 5 by default

RETURN VALUE

Packet which was captured

SEE ALSO

send_capture(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Send Arp Request (`doc/manual/nasl/built-in-functions/raw-ip-functions/send_arp_request.md`)

send_arp_request(3nasl)

NAME

send_arp_request - send an arp request to the scanned host

SYNOPSIS

string send_arp_request(pcap_timeout: int);

send_arp_request Takes 1 named argument

DESCRIPTION

This function creates a datalink layer frame for an arp request and sends it to the currently scanned host.

It takes the following argument:

  • pcap_timeout: time to wait for answer in seconds, 5 by default

RETURN VALUE

The answer of the arp request or NULL on error.

ERRORS

  • Unable to send frame
  • No answer received

Doc Manual Nasl Built In Functions Raw Ip Functions Send Capture (`doc/manual/nasl/built-in-functions/raw-ip-functions/send_capture.md`)

send_capture(3nasl)

NAME

send_capture - read the next packet

SYNOPSIS

string send_capture(interface: string, pcap_filter: string, timeout: int);

send_capture takes 3 named arguments.

DESCRIPTION

This function is the same as pcap_next(3nasl).

  • interface: network interface name, by default NASL will try to find the best one
  • pcap_filter: BPF filter, by default it listens to everything
  • timeout: timeout in seconds, 5 by default

RETURN VALUE

Packet which was captured

SEE ALSO

pcap_next(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Send Frame (`doc/manual/nasl/built-in-functions/raw-ip-functions/send_frame.md`)

send_frame(3nasl)

NAME

send_frame - send a frame to th scanned host

SYNOPSIS

string send_frame(frame: string, pcap_active: bool, pcap_filter: string, pcap_timeout: int);

send_frame takes 4 named arguments.

DESCRIPTION

Send a frame to the currently scanned host with the option to listen to the answer.

The arguments are:

  • frame: the frame to send, created with forge_frame(3nasl)
  • pcap_active: option to capture the answer, default is TRUE
  • pcap_filter: filter for the answer
  • pcap_timeout: time to wait for the answer in seconds, default 5

RETURN VALUE

The answer of the send frame

SEE ALSO

forge_frame(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Send Packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/send_packet.md`)

send_packet(3nasl)

NAME

send_packet - send a list of IP packets to the scanned host

SYNOPSIS

string send_packet(string..., length: int, pcap_active: bool, pcap_filter: string, pcap_timeout: int, allow_broadcast: bool);

send_packet takes 4 named and any number of positional arguments.

DESCRIPTION

Send a list of packets, passed as unnamed arguments, with the option to listen to the answers.

The arguments are:

  • Any number of packets to send
  • length: default length of each every packet, if a packet does not fit, its actual size is taken instead
  • pcap_active: option to capture the answers, TRUE by default
  • pcap_filter: BPF filter used for the answers
  • pcap_timeout: time to wait for the answers in seconds, 5 by default
  • allow_broadcast: default FALSE

RETURN VALUE

A block of all answers as a single string.

Doc Manual Nasl Built In Functions Raw Ip Functions Send V6packet (`doc/manual/nasl/built-in-functions/raw-ip-functions/send_v6packet.md`)

send_v6packet(3nasl)

NAME

send_v6packet - send a list of IPv6 packets to the scanned host

SYNOPSIS

string send_v6packet(string..., length: int, pcap_active: bool, pcap_filter: string, pcap_timeout: int, allow_multicast: bool);

send_v6packet takes 4 named and any number of positional arguments.

DESCRIPTION

Send a list of packets, passed as unnamed arguments, with the option to listen to the answers.

The arguments are:

  • Any number of packets to send
  • length: default length of each every packet, if a packet does not fit, its actual size is taken instead
  • pcap_active: option to capture the answers, TRUE by default
  • pcap_filter: BPF filter used for the answers
  • pcap_timeout: time to wait for the answers in seconds, 5 by default
  • allow_broadcast: default FALSE

RETURN VALUE

A block of all answers as a single string.

Doc Manual Nasl Built In Functions Raw Ip Functions Set Ip Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_ip_elements.md`)

set_ip_elements(3nasl)

NAME

set_ip_elements - modify the field of a IP datagram

SYNOPSIS

string set_ip_elements(ip: string, ip_hl: int, ip_id: int, ip_len: int, ip_off: int, ip_p: int, ip_src: string, ip_sum: int, ip_tos: int, ip_ttl: int, ip_v: int);

set_ip_elements takes up to 11 named arguments.

DESCRIPTION

Set element from a IP datagram. Its arguments are:

  • ip: IP datagram to set fields on
  • ip_hl: IP header length in 32 bits words, 5 by default
  • ip_id: datagram ID, random by default
  • ip_len: length of the datagram, 20 plus the length of the data
  • ip_off: fragment offset in 64 bits words, 0 by default
  • ip_p: IP protocol, 0 by default
  • ip_src: source address in ASCII, NASL will convert it into an integer in network order
  • ip_sum: packet header checksum, it will be computed by default
  • ip_tos: type of service field, 0 by default
  • ip_ttl: time to live field, 64 by default
  • ip_v: IP version, 4 by default

RETURN VALUE

Returns the modified IP datagram

Doc Manual Nasl Built In Functions Raw Ip Functions Set Ip V6 Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_ip_v6_elements.md`)

set_ip_v6_elements(3nasl)

NAME

set_ip_v6_elements - modify the field of a IPv6 datagram

SYNOPSIS

string set_ip_v6_elements(ip6: string, ip6_plen: int, ip6_hlim: int, ip6_nxt: string, ip6_src: int);

set_ip_v6_elements takes up to 5 named arguments.

DESCRIPTION

Set element from a IPv6 datagram. This function is the same as set_ipv6_elements(3nasl).

Its arguments are:

  • ip6: IPv6 datagram to set fields on
  • ip6_plen: payload length
  • ip6_hlim: hop limit, max 255
  • ip6_nxt: next packet
  • ip6_src: source address

RETURN VALUE

Returns the modified IPv6 datagram

SEE ALSO

set_ipv6_elements(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Set Ipv6 Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_ipv6_elements.md`)

set_ipv6_elements(3nasl)

NAME

set_ipv6_elements - modify the field of a IPv6 datagram

SYNOPSIS

string set_ipv6_elements(ip6: string, ip6_plen: int, ip6_hlim: int, ip6_nxt: string, ip6_src: int);

set_ipv6_elements takes up to 5 named arguments.

DESCRIPTION

Set element from a IPv6 datagram. This function is the same as set_ip_v6_elements(3nasl).

Its arguments are:

  • ip6: IPv6 datagram to set fields on
  • ip6_plen: payload length
  • ip6_hlim: hop limit, max 255
  • ip6_nxt: next packet
  • ip6_src: source address

RETURN VALUE

Returns the modified IPv6 datagram

SEE ALSO

set_ip_v6_elements(3nasl)

Doc Manual Nasl Built In Functions Raw Ip Functions Set Tcp Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_tcp_elements.md`)

set_tcp_elements(3nasl)

NAME

set_tcp_elements - modify the TCP fields of an IP datagram

SYNOPSIS

string set_tcp_elements(tcp: string, data: string, th_ack: int, th_dport: int, th_flags: int, th_off: int, th_seq: int, th_sport: int, th_sum: int, th_urp: int, th_win: int, th_x2: int, update_ip_len: int);

set_tcp_elements takes 13 named arguments.

DESCRIPTION

This function modifies the TCP fields of an IP datagram. Its arguments are:

  • data: is the TCP data payload.
  • tcp: is the IP datagram to be filled.
  • th_ack: is the acknowledge number. NASL will convert it into network order if necessary. 0 by default.
  • th_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • th_flags: are the TCP flags. 0 by default.
  • th_off: is the size of the TCP header in 32 bits words. By default, 5.
  • th_seq: is the TCP sequence number. NASL will convert it into network order if necessary. Random by default.
  • th_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • th_sum: is the TCP checksum. By default, the right value is computed.
  • th_urp: is the urgent pointer. 0 by default.
  • th_win: is the TCP window size. NASL will convert it into network order if necessary. 0 by default.
  • th_x2: is a reserved field and should probably be left unchanged. 0 by default.
  • update_ip_len: is a flag (TRUE by default). If set, NASL will recompute the size field of the IP datagram.

RETURN VALUE

The modified datagram

Doc Manual Nasl Built In Functions Raw Ip Functions Set Tcp V6 Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_tcp_v6_elements.md`)

set_tcp_v6_elements(3nasl)

NAME

set_tcp_v6_elements - modify the TCP fields of an IPv6 datagram

SYNOPSIS

string set_tcp_v6_elements(tcp: string, data: string, th_ack: int, th_dport: int, th_flags: int, th_off: int, th_seq: int, th_sport: int, th_sum: int, th_urp: int, th_win: int, th_x2: int, update_ip_len: int);

set_tcp_v6_elements takes 13 named arguments.

DESCRIPTION

This function modifies the TCP fields of an IPv6 datagram. Its arguments are:

  • tcp: is the IPv6 datagram to be filled.
  • data: is the TCP data payload.
  • th_ack: is the acknowledge number. NASL will convert it into network order if necessary. 0 by default.
  • th_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • th_flags: are the TCP flags. 0 by default.
  • th_off: is the size of the TCP header in 32 bits words. By default, 5.
  • th_seq: is the TCP sequence number. NASL will convert it into network order if necessary. Random by default.
  • th_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • th_sum: is the TCP checksum. By default, the right value is computed.
  • th_urp: is the urgent pointer. 0 by default.
  • th_win: is the TCP window size. NASL will convert it into network order if necessary. 0 by default.
  • th_x2: is a reserved field and should probably be left unchanged. 0 by default.
  • update_ip_len: is a flag (TRUE by default). If set, NASL will recompute the size field of the IP datagram.

RETURN VALUE

The modified datagram

Doc Manual Nasl Built In Functions Raw Ip Functions Set Udp Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_udp_elements.md`)

set_udp_elements(3nasl)

NAME

set_udp_elements - modify the UDP fields of an IP datagram

SYNOPSIS

string set_udp_elements(udp: string, data: string, uh_dport: int, uh_sport: int, uh_sum: int, uh_ulen: int);

set_udp_elements takes 6 named arguments.

DESCRIPTION

This function modifies the UDP fields of an IP datagram. Its arguments are:

  • udp: is the IP datagram to be filled.
  • data: is the payload.
  • uh_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sum: is the UDP checksum. Although it is not compulsory, the right value is computed by default.
  • uh_ulen: is the data length. By default it is set to the length the data argument plus the size of the UDP header.

RETURN VALUE

The modified datagram

Doc Manual Nasl Built In Functions Raw Ip Functions Set Udp V6 Elements (`doc/manual/nasl/built-in-functions/raw-ip-functions/set_udp_v6_elements.md`)

set_udp_v6_elements(3nasl)

NAME

set_udp_v6_elements - modify the UDP fields of an IPv6 datagram

SYNOPSIS

string set_udp_v6_elements(udp: string, data: string, uh_dport: int, uh_sport: int, uh_sum: int, uh_ulen: int);

set_udp_v6_elements takes 6 named arguments.

DESCRIPTION

This function modifies the UDP fields of an IPv6 datagram. Its arguments are:

  • udp: is the IPv6 datagram to be filled.
  • data: is the payload.
  • uh_dport: is the destination port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sport: is the source port. NASL will convert it into network order if necessary. 0 by default.
  • uh_sum: is the UDP checksum. Although it is not compulsory, the right value is computed by default.
  • uh_ulen: is the data length. By default it is set to the length the data argument plus the size of the UDP header.

RETURN VALUE

The modified datagram

Doc Manual Nasl Built In Functions Raw Ip Functions Tcp Ping (`doc/manual/nasl/built-in-functions/raw-ip-functions/tcp_ping.md`)

tcp_ping(3nasl)

NAME

tcp_ping - Launches a TCP ping against the target host

SYNOPSIS

bool tcp_ping(port: int);

tcp_ping takes 1 named argument.

DESCRIPTION

This function tries to open a TCP connection and sees if anything comes back (SYN/ACK or RST).

Its argument is:

  • port: port for the ping

RETURN VALUE

TRUE on success, FALSE on failure

Doc Manual Nasl Built In Functions Raw Ip Functions Tcp V6 Ping (`doc/manual/nasl/built-in-functions/raw-ip-functions/tcp_v6_ping.md`)

tcp_v6_ping(3nasl)

NAME

tcp_v6_ping - Launches a TCP ping against the target host

SYNOPSIS

bool tcp_v6_ping(port: int);

tcp_v6_ping takes 1 named argument.

DESCRIPTION

This function tries to open a TCP connection and sees if anything comes back (SYN/ACK or RST).

Its argument is:

  • port: port for the ping

RETURN VALUE

TRUE on success, FALSE on failure

Doc Manual Nasl Built In Functions Regular Expressions Egrep (`doc/manual/nasl/built-in-functions/regular-expressions/egrep.md`)

egrep(3nasl)

NAME

egrep - looks for a pattern in a string line by line and concatenates all lines the string was found

SYNOPSIS

string egrep(string: string, pattern: string, icase: bool, rnul: bool);

string ereg_replace(string: string, pattern: string, replace: string, icase: bool, rnul: bool);

DESCRIPTION

This function takes a string and searches for a pattern in it line by line. Each line, which had a match is then concatenate and returned.

The named argument string is a string containing the string to be searched.

The named argument pattern is a string containing the pattern to search for.

The optional named argument icase is a bool and is used as a flag to enable/disable case sensitivity. Its default value is FALSE. FALSE means case sensitive, TRUE means case insensitive.

The optional named argument rnul is a bool and is used as a flag to enable/disable escaping nul-characters. Its default value is TRUE. TRUE means nul-characters are escaped. This enables to match strings with a nul-character in it, as such normally are used to mark the end of a string.

RETURN VALUE

The concatenated lines, in which the pattern was found as string or NULL on error.

ERRORS

One of the arguments string or pattern are missing.

Unable to compile pattern.

Doc Manual Nasl Built In Functions Regular Expressions Ereg (`doc/manual/nasl/built-in-functions/regular-expressions/ereg.md`)

ereg(3nasl)

NAME

ereg - matches a given string against a regular expression

SYNOPSIS

bool ereg(string: string, pattern: string, icase: bool, rnul: bool, multiline: bool);

ereg takes up to 5 named arguments.

DESCRIPTION

This function takes a string and matches it against a regular expression.

The named argument string is a string containing the string to be searched.

The named argument pattern is a string containing the pattern to search for.

The optional named argument icase is a bool and is used as a flag to enable/disable case sensitivity. Its default value is FALSE. FALSE means case sensitive, TRUE means case insensitive.

The optional named argument rnul is a bool and is used as a flag to enable/disable escaping nul-characters. Its default value is TRUE. TRUE means nul-characters are escaped. This enables to match strings with a nul-character in it, as such normally are used to mark the end of a string.

The named argument multiline is a bool and is used as a flag to enable/disable multiline strings. It

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#c Browse c catalog → #foo Browse foo catalog → #greenbone Browse greenbone catalog → #greenbone-community-edition Browse greenbone-community-edition catalog → #greenbone-vulnerability-management Browse greenbone-vulnerability-management catalog → #gvm Browse gvm catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →