Backtrack 5 : Information Gathering : Network Analysis : Identify Live Hosts : pbnj

PBNJ is made ip of two commands which are scanpbnj and outputpbnj. The manpages for both scanpbnj and outputpbnj are located in collapsed tables at the bottom of this post in case you want more details. When you run scanpbnj it technically a script that runs nmap and dumps the results to a database. The scanpbnj command will store results in various database formats including CSV, MySQL, PostgreSQL, and SQLite. Once the results are stored you can pull the results from the database using outputpbnj which can output report style results in CSV format, tab delimited format, or HTML format. Continue reading below for more details regarding outputpbnj and scanpbnj on Backtrack Linux 5 r2.

PBNJ: scanpbnj Details:

As noted above scanpbnj simply runs nmap with a default set of nmap switches that can be modified though and then stores those nmap results to a database. I will list a couple examples of how to use scanpbnj to output results to a SQLite database as well as a CSV file. It should be noted that if you want to use scanpbnj to output results to a CSV file on Backtrack Linux you will need to install a package as described in this article. The first example below shows a basic scanpbnj command that outputs results for a couple IP addresses to a SQLite database.

The below output shows the list of IP addresses in a file named “iplist” being fed to scanpbnj in all of the below examples.

List Of IP Addresses Used In All PBNJ Examples Below:

Here is a brief explanation of the switches used with the scanpbnj command in the example below.

PBNJ: Explanation Of Switches Used With scanpbnj First Example Below:

• -i iplist: The -i switch allows you to point to a list of IP addresses in a file
• -p: Ping sweep every target and then only scan the targets that are alive
• –dir /pbnjdir: Specifies the directory of the CSV or SQLite database file as well as the location of the -i file
• –test 10: Provides detailed output to the screen, helpful in examples or when debugging issues

PBNJ: Use scanpbnj To Output Results nmap Scan Results To SQLite:

As you can see above two of the four IP addresses responded to the ping sweep so only two IP’s were scanned with nmap. Using the “–test 10” command line configuration option spits out useful information like the location of the nmap, which is /usr/local/bin/nmap, that scanpbnj uses and the nmap switches used for the scan, which in this case were “Scan Args are -vv -O -P0 -sSV -p 1-1025”. You can above that there are a couple ports open on each of the alive IP addresses and those results are now stored in a SQLite database file. If you were to continue to run scanpbnj on a regular basis results would be updated if things change and then you could use outputpbnj to run reports on the SQLite database file.

PBNJ: Output scanpbnj Results To CSV File On Backtrack Linux:

One way that I find scanpbnj to be more useful since I don’t typically continue scanning the same network over and over is to output the scanpbnj results directly to a CSV file to analyze. To do this you first need to modify the scanpbnj config.yaml file located in your home directory under the .pbnj-2.0/ folder. If you were logged in as root the full path to the pbnj config.yaml file would be the same as the below example output.

PBNJ: Path To PBNJ config.yaml File When Run As Root:

The default contents of the config.yaml file are similar to the below except instead of “db: CSV” the default setting is “db: SQLite” which is commented out right above the CSV setting. Below is the output of the config.yaml file after I modified it to output results to CSV instead of the default SQLite database.

PBNJ: Modified pbnj config.yaml File To Output Results To CSV:

Now if you were to run the exact same command as the first example the results would be output to CSV files instead of a SQLite database. Just to provide details of how results look in CSV instead of the SQLite database we will go ahead and run scanpbnj exactly like the first example with only the config.yaml file modified.

PBNJ: Use scanpbnj To Output Results nmap Scan Results To CSV Files:

As you can see above the output is exactly the same as when the results were dumped to SQLite however this time instead of a data.dbl file the results are dumped to two CSV files named machine and services. The machine CSV includes the IP of the device, the hostname if available, the Operating System if available, and a couple different timestamps. The services CSV file includes the service, the state of the service, the service port, the service protocol, the service version, the service banner, and a couple timestamps. Examples of each of these files are listed below.

PBNJ: Example scanpbnj Output To machines CSV File:

PBNJ: Example scanpbnj Output To services CSV File:

I really like the CSV output as it is the easiest for me to manipulate for reports, etc. without having to mess with using outputpbnj to extract the database from either a SQLite, Mysql, or PostgreSQL database. The unfortunate part about dumping to CSV files is I don’t see (it is possible I am missing this) how the devices in the machines CSV file are tied to services in the services CSV file. I would however prefer MySQL or PostgreSQL if I were using scanpbnj to run a nightly scan via a cronjob or something similar.

Now that we have the basics of scanpbnj down lets move on to a quick outputpbnj example. In the below example I have switched the config.yaml file back to “db: SQLite” to show a couple real world examples of how outputpbnj is useful. First however we show outputpbnj with the –list switch to show each of the preconfigured output reports available using outputpbnj.

**Note** The outputpbnj command is broken on Backtrack 5 R2 but can easily be fixed by following the instructions here.

PBNJ: List Of outputpbnj Queries Available:

Now below we show three of the above queries being used with outputpbnj.

PBNJ: Use outputpbnj To Extract scanpbnj Results From SQLite Database File:

Above we show three different outputs using the outputpbnj command. This is slick because if you had scanpbnj running in a cron and then followed that up by outputpbnj running in cron as well you could easily get a nightly email report of devices on your network along with the services that those devices are running. The switches are fairly easy above but just remember when using outputpbnj to specify the database file using –data.

Click on either scanpbnj man page or outputpbnj man page below to view the entire manpage for each PBNJ application below.

Click here to see PBNJ’s SourceForge page or click here for more Kali Linux articles.