Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

Full Version: Scanresultfilter
Rafter
Hi,

I was looking for a tool to process and filter scanline result file...
but didn't succeed or it wasn't doing all what I wanted, so I decided to write my own smile.gif

Now it's done and I hope you'll likeit too!!
I wrote it with C#, so that means you need to have the .NET Framework installed to have it working.

This is how it looks like:
user posted image

I'm not writing an "How-to" as I think it's simple enough to understand as is wink.gif

For those who are interested in the source files, it is available there:
C# - ScanResultFilter

Enjoy !!
realloader
Yes, i have test it..it work....but im not sure whether i like it or not!.
spook
Good thing you made it "not bound"

That's a big pro.

But unfortunately, I've also found a "bug"

I tried it on a file over 1mb and it hung. And after a minute of 5, it was loaded. Maybe you could speed this process up a bit?

The ? "about" didn't seem to be working.

Overall it's a good program for filtering scanline results smile.gif
vnet576
QUOTE(realloader @ Aug 17 2005, 07:42 AM)
Yes, i have test it..it work....but im not sure whether i like it or not!.
*



Provide constructive feedback like the guy below you. How will your post help the original poster improve his program? (Always keep that in mind when posting replies).
Rafter
QUOTE(spook @ Aug 17 2005, 03:36 PM)
I tried it on a file over 1mb and it hung. And after a minute of 5, it was loaded. Maybe you could speed this process up a bit?

The ? "about" didn't seem to be working.
*


Thanks for the feedback spook smile.gif

Indeed I forgot the about page tongue.gif
I just correccted that and wrote my name in big letters biggrin.gif biggrin.gif

Now for the performance problem, I found out the same... so I need to think again how I can improve all that wink.gif

Anyway I'll post any update there so that everybody can be up to date.

[New version, with about is now available tongue.gif)
Killaloop
QUOTE(Rafter @ Aug 17 2005, 03:07 PM)
Thanks for the feedback spook smile.gif

Indeed I forgot the about page tongue.gif
I just correccted that and wrote my name in big letters biggrin.gif biggrin.gif

Now for the performance problem, I found out the same... so I need to think again how I can improve all that wink.gif

Anyway I'll post any update there so that everybody can be up to date.

[New version, with about is now available tongue.gif)
*


the problem is you use for "loops" to read the information.
for is very slow and uses up alot memory.
try using while loops and you will see much better performance.
I have had the same problem with a md5 dictionary cracker, it took ages to load a 70mb dictionary, but with while loops it reads the file within not even one second.
for is not really a loop, no clue how the asm code looks like, but it has bad performance
Rafter
QUOTE(Killaloop @ Aug 17 2005, 05:11 PM)
the problem is you use for "loops" to read the information.
for is very slow and uses up alot memory.
try using while loops and you will see much better performance.
I have had the same problem with a md5 dictionary cracker, it took ages to load a 70mb dictionary, but with while loops it reads the file within not even one second.
for is not really a loop, no clue how the asm code looks like, but it has bad performance
*


Thx for the tip Killaloop

But in this case the performance problem doesn't come from reading and processing the source file. This is done in a matter of a second even for a file of 1Mb!!

What takes time is the insert of rows into the Acess DB sad.gif sad.gif
And because you can't do multiple insert at a time in Access, or a bulk insert...
I'm still not sure how to solve that issue wink.gif

If anybody has an idea...
brOmstar
Hi i wrote a similar program some time ago ..to prevent the problem that it seems to hang during loading a big file try to load the file with an own thread..so you can show informations about the loading process in the form and you can recieve input to the form like stop loading etc. so the user feel better cause something ahppens and he can interact with the program.

If you want to load really big files > 50 mb you should have problems with the simple textbox( i had ) change it to richtextbox and it will work perfect.. hope that helps you to improve your handy tool wink.gif


btw why do you write it into an access db ? I used an array and it works ...as long as your file isn't bigger then your memory wink.gif
Rafter
QUOTE(brOmstar @ Aug 17 2005, 05:59 PM)
Hi i wrote a similar program some time ago ..to prevent the problem that it seems to hang during loading a big file try to load the file with an own thread..so you can show informations about the loading process in the form and you can recieve input to the form like stop loading etc. so the user feel better cause something ahppens and he can interact with the program.

If you want to load really big files > 50 mb you should have problems with the simple textbox( i had ) change it to richtextbox and it will work perfect.. hope that helps you to improve your handy tool wink.gif


btw why do you write it into an access db ? I used an array and it works ...as long as your file isn't bigger then your memory wink.gif
*


Actually I'm not loading the file directly to the DB...

The whole process looks like:
1) Reading the file line per line in order to process it and match the correct the banner to its corresponding ip-protocol-port.
2) Inserting each line to the Db <- that's where because of Access limitation you HAVE To do it line per line, and you can not execute one command to insert them all at once sad.gif

As for why using a DB ?
The answer is :
I thought that would be the easiest way to select, sort and filter the whole bunch of data wink.gif
Thanks to that you are not bound to the .NET objects filtering/sorting facilities smile.gif

Regarding the process bar and the thread features, I was also thinking of that...
and I'll sure will implement it if I can not improve the loading performance be either using another DB, or another system of storing the data!
brOmstar
I used regular expression they are very fast and in the basic classes of the .NET framework and not bound to anything else then the basic framework. If you are really interested i would send you my src but keep that src privat then ...pm me if interested.
suck_commander
hi

i got some problems with the prog.
every time when i try to open my scan result file the prog give me an error :
Error the connection is already open (state=open)
i can click ok
a new window pops up sayin: an unhandled exception has occurred in your application......


thank you for help






detail:


See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.InvalidOperationException: The connection is already Open (state=Open).
at System.Data.OleDb.OleDbConnection.Open()
at ScanResultFilter.ScanlineResult.FilterResult(String select, String condition)
at ScanResultFilter.ScanResultFilterWindow.FilterResult(String select, String condition)
at ScanResultFilter.ScanResultFilterWindow.OpenFile()
at ScanResultFilter.ScanResultFilterWindow.buttonOpenFile_Click(Object sender, EventArgs e)
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/microsoft.net/framework/v1.1.4322/mscorlib.dll
----------------------------------------
ScanResultFilter
Assembly Version: 1.0.2055.28913
Win32 Version: 1.0.2055.28913
CodeBase: file:///E:/Dokumente%20und%20Einstellungen/sucki/Desktop/ScanResultFilter/ScanResultFilter.exe
----------------------------------------
System.Windows.Forms
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/assembly/gac/system.windows.forms/1.0.5000.0__b77a5c561934e089/system.windows.forms.dll
----------------------------------------
System
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/assembly/gac/system/1.0.5000.0__b77a5c561934e089/system.dll
----------------------------------------
System.Drawing
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/assembly/gac/system.drawing/1.0.5000.0__b03f5f7f11d50a3a/system.drawing.dll
----------------------------------------
System.Data
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/assembly/gac/system.data/1.0.5000.0__b77a5c561934e089/system.data.dll
----------------------------------------
System.Xml
Assembly Version: 1.0.5000.0
Win32 Version: 1.1.4322.573
CodeBase: file:///e:/windows/assembly/gac/system.xml/1.0.5000.0__b77a5c561934e089/system.xml.dll
----------------------------------------

************** JIT Debugging **************
To enable just in time (JIT) debugging, the config file for this
application or machine (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the machine
rather than being handled by this dialog.



This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.