gonmap

Use SetTimeout to define the default duration used for probe requests during a scan.

nmapInstance.SetTimeout(2 * time.Second)

Use GuessProtocol(port int) to determine the likely protocol running on a specific port. If the port is unknown, it defaults to http.

protocol := gonmap.GuessProtocol(80)
// returns "http"

To get a fresh instance of the Nmap engine based on the current global configuration, call New(). This returns a pointer to an Nmap struct that is a copy of the initialized global state.

n := gonmap.New()

The gonmap package uses a Logger interface to manage library logging. By default, it logs to os.Stderr with a [gonmap] prefix. You can provide your own implementation of the Logger interface to redirect logs to your application's logging system using SetLogger.

type Logger interface {
	Printf(format string, v ...interface{})
	Println(v ...interface{})
}

// To use your own logger:
// SetLogger(myCustomLogger)

The FixProtocol(oldProtocol string) function is used to clean up and normalize protocol strings for final output. It performs several transformations:

• Converts ssl/http to https.
• Converts http-proxy to http.
• Maps specific service names like ms-wbt-server to rdp, microsoft-ds to smb, and ms-sql-s to mssql.
• Handles ssl/ prefixes by converting them to -ssl suffixes (e.g., ssl/ssh becomes ssh-ssl).
• Replaces underscores _ with hyphens -.
• Prepends S to protocols that start with a digit.

cleanName := gonmap.FixProtocol("ssl/http")
// returns "https"

cleanName := gonmap.FixProtocol("ms-wbt-server")
// returns "rdp"

The Scan method performs a service version detection scan on a specific IP and port. It uses a sequence of probes (requests) to identify the service running on the port. The process involves:

1. Selecting probes based on the port (using portProbeMap).
2. Attempting the first probe.
3. If the first probe doesn't result in a Matched or Closed status, it iterates through remaining probes.
4. If an SSL service is detected, it performs secondary SSL/HTTPS probes to refine the identification.

Returns a Status (e.g., Matched, Closed, Open, NotMatched) and a *Response containing the raw data and FingerPrint.

status, response := nmapInstance.Scan("127.0.0.1", 80)

Calling OpenDeepIdentify enables deep service version detection (similar to the -sV flag in Nmap). It configures the scanner to use the full allProbeMap (the sorted list of all available probes) instead of just port-specific probes.

nmapInstance.OpenDeepIdentify()

You can control the initialization and filtering of Nmap probes using SetFilter(filter int). This re-initializes the internal Nmap engine with the specified filter level. This is useful if you need to adjust the depth or scope of the fingerprinting logic during runtime.

// Set the filter level
gonmap.SetFilter(9)

The AddMatch method allows you to extend an existing probe's matching capabilities by adding a new regular expression expression. This is used to refine how a specific probeName identifies a service.

nmapInstance.AddMatch("HTTP", "Server: Apache/.*")

The Status type represents the outcome of a scan. It is an integer type that can be converted to a human-readable string using the .String() method. Use the following constants to check the state of a service or port:

// Example of checking a status
if status == gonmap.Open {
    fmt.Println("Port is open")
}

// Example of getting the string representation
fmt.Println(status.String()) // Outputs: "Open", "Closed", etc.

The ScanTimeout method is a wrapper around Scan that enforces a hard deadline using a context.WithTimeout. This is useful for preventing scans from hanging indefinitely on unresponsive hosts.

If the timeout is reached before the scan completes, it returns Closed and nil.

status, response := nmapInstance.ScanTimeout("127.0.0.1", 443, 5 * time.Second)