NBE(3pm)

💖 NBE (aka Parse::Nessus::NBE) 💖

okay bestie, grab a snack 🍓 because this is the manual page for Parse::Nessus::NBE, and I need you to know it is so much cooler than it sounds. It's giving "I have a folder full of Nessus scan output and I need to actually do something with it" energy. Let's go 💅

---

🎀 NAME 🎀

Parse::Nessus::NBE — use to extract specific data from Nessus NBE files

---

✨ SYNOPSIS ✨

look at this, so clean, so elegant 🦋

        use Parse::Nessus::NBE;

        function(@nessusdata);

        function(@nessusdata,$query);

see? every function can be called with just the data, or with the data and a little query extra. periodt 💜

---

🌸 DESCRIPTION 🌸

okay so real talk: this module exists to pull info out of Nessus NBE files, no cap. 🔥

some of the functions are built to hand you back whole sets of data — think service banners, OS versions, that kind of thing. and then there are the other functions, the ones that get all specific on you: like every single IP that's listening on a port you name, or every IP that's tied to a plugin id you specify. it's giving "I know exactly what I'm looking for and I want it now" 👑

---

👑 EXAMPLES 👑

the moment you've all been waiting for. let's run through them one by one, bestie 🫶

🌈 To obtain a list of banners

        my @banners =  nbanners(@nessusdata);
        print @banners;

        # returns
        IP|service banner

        # example
        192.168.0.5|CompaqHTTPServer/2.1
        192.168.0.11|Apache/1.3.26 (Unix) mod_perl/1.24
        192.168.0.30|Microsoft-IIS/5.0
        192.168.0.31|220 cpan01 FTP server (SunOS 5.8) ready.
        192.168.0.51|NetWare HTTP Stack
        192.168.0.99|220 Service ready for new user.
        ...

badges? we got badges. every line is IP|service banner and honestly the Compaq one is sending me 😭

🦋 To query by port

        my $port = 80;
        my @ports = nports(@nessusdata,$port);
        print @ports;

        # returns
        IP|specified port

        # example
        192.168.0.5|ssh (22/tcp)
        192.168.0.6|ssh (22/tcp)
        192.168.0.8|ssh (22/tcp)
        192.168.0.23|ssh (22/tcp)
        192.168.0.89|ssh (22/tcp)
        ...

ngl the example asks for port 80 but the output is all about ssh (22/tcp) — iconic behavior, we don't question it, the vibe is the vibe 🙈

🧚 To obtain a list of web directories

        my @webdirs = nwebdirs(@nessusdata);
        print @webdirs;

        # returns
        IP|web port|web dir(s)|web dir(s) requiring authentication

        # example
        192.168.0.21|http (80/tcp)|/css /design /downloads /images /js
        192.168.0.43|http (80/tcp)|/images /public|/console
        192.168.0.47|https (443/tcp)|/files /html /images /js /jsp
        192.168.0.101|https (443/tcp)|/application /common /images /report|/printers
        192.168.0.110|http (80/tcp)|/admin
        ...

four fields, pipe-separated, and the last one is the dirs that want your creds. /console and /printers said "auth required" and honestly, same 💅

💜 To obtain a list of nfs shares

        my @nfs = nnfs(@nessusdata);
        print @nfs;

        # returns
        IP|nfs port|nfs share(s)

        # example
        192.168.0.11|nfs (2049/tcp)|/apps (mountable by everyone)
        192.168.0.31|nfs (2049/tcp)|/cdrom (mountable by everyone)
        192.168.0.28|nfs (2049/tcp)|/data (mountable by everyone)
        192.168.0.45|nfs (2049/tcp)|You are running a superfluous NFS daemon...
        192.168.0.108|nfs (2049/tcp)|You are running a superfluous NFS daemon...
        ...

"mountable by everyone" is wild and also "You are running a superfluous NFS daemon..." is such a read 💀 the scanner really said that

🌟 To obtain a OS listing

        my @os = nos(@nessusdata);
        print @os;

        # returns
        IP|OS version

        # example
        192.168.0.1|IOS 12.1.5-12.2(6a), Cisco IOS 12.1(5)-12.2(7a)
        192.168.0.154|Linux 2.1.19 - 2.2.20
        192.168.0.111|HP Advancestack Etherswitch 224T or 210
        192.168.0.92|AIX 4.2-4.3.3
        192.168.0.10|NT Server 4.0 SP4-SP5 running Checkpoint Firewall-1
        ...

look at those OS fingerprints, we love a messy heterogeneous network 😌

✨ To obtain a listing of SNMP community strings

        my @snmp = nsnmp(@nessusdata);
        print @snmp;

        # returns
        IP|SNMP community string(s)

        # example
        192.168.0.1|private public
        192.168.0.111|public
        192.168.0.121|private public
        192.168.0.128|private public
        192.168.0.145|public
        ...

private public — the original "password is password" move 🔥 bestie please change those

💖 To query by plugin id

        my $plugin = 10667;
        my @plugin = nplugin(@nessusdata,$plugin);
        print @plugin;

        # returns
        IP|port|plugin data

        # example
        192.168.0.202|https (443/tcp)|...OpenSSL which is;older than 0.9.6e...
        192.168.0.222|https (443/tcp)|...OpenSSL which is;older than 0.9.6e...
        192.168.0.235|https (443/tcp)|...OpenSSL which is;older than 0.9.6e...
        192.168.0.236|https (443/tcp)|...OpenSSL which is;older than 0.9.6e...
        192.168.0.237|https (443/tcp)|...OpenSSL which is;older than 0.9.6e...
        ...

give it a plugin id, get back every host it hit. 10667 said "I'm gonna find every old OpenSSL and I'm gonna be dramatic about it" 😭

🎀 To obtain a OS count, useful for graphing

        my @countos = nstatos(nessusdata);
        print @countos;

        # returns
        OS version|count

        # example
        Windows NT4 or 95/98/98SE|17
        Windows 2000 Advanced Server SP3|14
        TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)|11
        Cisco router running IOS 12.1.5-12.2.13a|11
        PS2 Linux 1.0|9
        Linux 2.4.17 on HP 9000 s700|7
        Cisco 2620 running IOS 12.1(6)|6
        Windows 2000 Server SP3|5
        Windows NT4 Workstation SP6a|4
        Nortel/Alteon ACE Director 3 Version 6.0.42-B|4

heads up bestie: this one passes nessusdata without the @. that's exactly how it's written up top, so that's exactly how I'm leaving it 🫶

statistics! for graphs! the numbers go OS version|count and TOPS-20 showing up with 11 hosts is genuinely main character energy 👑

🌈 To obtain a service count, useful for graphing

        my @countservices = nstatservices(nessusdata);
        print @countservices;

        # returns
        service port|count

        #example
        http (80/tcp)|69
        telnet (23/tcp)|48
        netbios-ssn (139/tcp)|48
        https (443/tcp)|46
        loc-srv (135/tcp)|42
        ftp (21/tcp)|39
        smtp (25/tcp)|34
        pcanywheredata (5631/tcp)|30
        ssh (22/tcp)|25
        sun-answerbook (8888/tcp)|22

(the #example up there with no space is not a typo, that's literally the original, we respect it 💅) and yes, same thing here — nessusdata, no @. format is service port|count, perfect for plotting 📊

🔥 To obtain a vulnerability count, useful for graphing

        # note: options are as follows:
        # 1 returns high severity vulnerabilties
        # 2 returns medium severity vulnerabilities
        # 3 returns low level security notes

        my @countvulns = nstatvulns(@nessusdata,1);
        print @countvulns;

        #returns
        plugin id|count

        #example
        11875|40
        11412|17
        10116|12
        11856|11
        10932|10
        10937|7
        11793|6

okay so this one takes a number as the second arg, and the options are literally:

• 1 → high severity vulnerabilties
• 2 → medium severity vulnerabilities
• 3 → low level security notes

and the output is plugin id|count. so you pass your severity and get the receipts 🔍

---

🫶 AUTHOR 🫶

David J Kyger <dave@norootsquash.net>

---

💜 Thanks 💜

Gwendolynn ferch Elydyr <gwen@reptiles.org>

(huge shoutout, we appreciate you, bestie 🥹)

---

🌸 COPYRIGHT 🌸

Copyright 2003 David J Kyger. All rights reserved.

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

and that's the whole thing! 💖 this page is from perl v5.36.0, dated 2022-10-22 — go extract some data, you've got this, slay ✨🦋💅