SAINT is a network security tool. I have added some stuff to it that will enable it to:
  1. Do some simply community string guessing , warning if guessed.
  2. If read string guessed (or given), use sysDescr info to aid in figuring out what the hosttype is.

Download the package

Here it is

SNMP Libraries/ licensing

Makes use of the Perl SNMP libraries created by Simon Leinen.

No explicit license given with SNMP code, so unsure what status is. Since Simon Leinen is currently distributing his stuff on the web, shouldn't be a major issue. A version of his SMNP Perl libraries in included with this module, but all licensing questions should go to his page

I, Tom Payerle, license all my original code in this package under standard SAINT/SATAN license.

Summary of Changes

New files

Part of Simon Leinen's SNMP libraries for Perl

New file. Contains list of read community strings for specific hosts. So that SAINT can pick up SNMP sysDescr for device even if community string cannot be guessed.

blurb on why probably don't want guessable community strings

Actual probe code.

Basically, text version of this page

Modified files

Modified so that it will look at snmp records as well as telnet, ftp, smtp in identifying host via rules/hosttype. Also added a line to require when run outside saint, as this was hanging up.

Modified to call snmp.saint (with write community guessing enabled) if host offers SNMP
added a 120 second timeout for snmp.saint

Probe algorithm, etc

The probe reads in the file.

If it is given the read community for a host, it connects with that string and reads sysDescr. If can't connect, it continues as if wasn't given the read community string. If string given and not told to ignore guessable strings for that host, will complain if string is in the list of strings to guess.

If no read community string given, or it was wrong, it tries to guess it. This is currently done in a simple, brute force method, it tries everything on a list, currently short (public, private, and null). If it succeeds in connecting, it reads sysDescr for host-typing, and generates a warning.

If called with the "-w" flag, (current todo uses it), it will also try to guess the write community string. This is not only brutish but invasive (it tries to connect, then to prove is a write community, resets sysLocation. It will try to set back to original if succeeds). If it guesses a write community, warns about that as well.

Not elegant or efficient, but works (albeit requires somewhat large timeout value if needs to guess).