Support UDP Ports in Data Model

[TrebledJ]

Would be cool to have support for UDP ports, even if they are slightly rarer in the wild. Opening this issue as I haven't seen prior discussion on it.

Some thoughts and considerations after toying with this for a while:

• Introduce a new event OPEN_UDP_PORT or make a generic OPEN_PORT event with a udp flag in data_json?
• Seeding concerns: If we do take the separate event (OPEN_UDP_PORT) approach, when the scanner receives a host-port seed such as example.com:161, how do we differentiate between whether this is a TCP/UDP port? The regex will be the same for both, which will cause conflicts. Granted, this is probably not that big of a deal-- if someone is seeding a host-port, chances are it's some service running on TCP.

I can consider spending some time on this, but wanted to see if there's any preference on the data modelling or potential gotchas that flew over my head. (TBH, part of me is curious why the initial design was an OPEN_TCP_PORT event and not a more generic OPEN_PORT.)

[TheTechromancer]

@TrebledJ thanks for the observation. This is definitely something we want to support and we'd appreciate help on it. We already have a module for brute forcing SNMP (UDP 161/162), which is currently unused due to lack of UDP port scanner.

Most likely we'd use nmap for this as to my knowledge it's the best UDP scanner, although we could experiment with others like udpx.

We can use the OPEN_UDP_PORT with the same format as TCP, and augment the speculate module to create speculative UDP ports from seeds, so that if the user specifies an open port, both UDP and TCP are tried.

[TrebledJ]

Those are some great ideas. I notice masscan also supports UDP scanning and have been toying with a modified portscan module which uses masscan's U: and could hopefully make the portscanning interface more unified. But I'm also curious about your preference for nmap/udpx over the existing tool (masscan)?

[TheTechromancer]

Masscan would be ideal for speed, but its UDP payloads are more basic than nmap's, so we'd want to test it out for reliability.

If we run masscan against real targets and it reliably detects the most common / most attackable udp services (DNS, SNMP, TFTP,), then it's a no brainer over nmap.