sbroddy/nmapdb

nmapdb parses nmap's XML output files and inserts them into an SQLite database.

I coded this a while back (mid 2009) and have been using it since.  Some
people I have shared nmapdb with have found it useful, so I am releasing it
publicly.

Example usage:

$ sudo nmap -A -oX scanme.xml scanme.nmap.org

Starting Nmap ...

$ ls scanme.xml
scanme.xml
$ ./nmapdb.py -h
usage: ./nmapdb.py [options] <nmap output XML file(s)>
options:
     (-h) --help         this message
     (-v) --verbose      verbose output
     (-c) --create       specify input SQL file to create SQLite DB
     (-d) --database     specify output SQLite DB file
     (-f) --frequency    list most frequent open ports from specified DB
     (-n) --nodb         do not perform any DB operations (i.e. dry run)
     (-V) --version      output version number and exit

Use -c to create a database from the schema on the first run:

$ ./nmapdb.py -c nmapdb.sql -d myscan.db scanme.xml
$ file myscan.db
myscan.db: SQLite 3.x database
$ sqlite3 myscan.db
SQLite version 3.7.7 ...
sqlite> select * from hosts;
74.207.244.221||scanme.nmap.org|ipv4|Linux 2.6.18|Linux|85|2.6.X|1316681984|up|
sqlite> select * from ports;
74.207.244.221|22|tcp|ssh|open|
74.207.244.221|80|tcp|http|open|

Subsequent scans can be entered into the same database:

$ ./nmapdb.py -d myscan.db bar.xml foo.xml host1.xml host2.xml \
    host3.xml host4.xml meh.xml (or simply *.xml)
$ sqlite3 myscan.db
SQLite version 3.7.7 ...
sqlite> select * from ports where ports.port='22';
aa.bb.244.221|22|tcp|ssh|open|
204.cc.ddd.250|22|tcp|ssh|open|
bbb.242.aa.180|22|tcp|ssh|open|
aa.bb.121.21|22|tcp|ssh|open|
sqlite> select * from ports where ports.port='23';
192.168.1.254|23|tcp|telnet|open|
sqlite> select * from hosts inner join ports on hosts.ip=ports.ip where hosts.ip='192.168.1.254' and ports.state='open';
192.168.1.254|00:00:C5:CF:86:30|modem|ipv4||||||up|Farallon Computing/netopia|192.168.1.254|23|tcp|telnet|open|
192.168.1.254|00:00:C5:CF:86:30|modem|ipv4||||||up|Farallon Computing/netopia|192.168.1.254|80|tcp|http|open|
sqlite> select * from hosts inner join ports on hosts.ip=ports.ip where hosts.os_name like '%bsd%' and ports.port=22;
aa.bb.91.25||foo.bar.org|ipv4|FreeBSD 7.0-STABLE|FreeBSD|95|7.X|1231841556|up||aa.bb.91.25|22|tcp|ssh|open|

Feel free to fork, submit patches, whatever.

Thanks to antonat and thomas for providing feedback.

argp, Mon Apr 30 14:49:21 EEST 2012
sbroddy / nmapdb

About

Languages
