Some Nmap + critical.io fingerprint matching stuff

:~/nmap$ cat extract.py
#!/usr/bin/env python

# Extract just the banner from critical.io's json output

import fileinput
import json

for l in fileinput.input():
    print repr(json.loads(l)["banner"])

:~/nmap$ cat matchme.pl
#!/usr/bin/perl

# Filter out service banners that Nmap already knows about

use strict;
use warnings;
use autodie;
use 5.012;

# Read in the service match lines
open my $db, '<', "nmap-src/nmap-service-probes";
my @pats;
while (<$db>) {
    # Skip irrelevant lines, but capture patterns
    next unless /^match \S+ m(.)(.*?)\1/;
    # compile the matches
    push @pats, qr/$2/;
}

# Read in each banner (Python repr() format)
WORD: while (<>) {
    # Handle quoting stuff with a dangerous eval
    my $str;
    my $do = "str = $_;";
    $do =~ s/(["\@\$])/\\$1/g;
    $do =~ s/u?'/"/g;
    eval "\$$do";
    # Bail if there's a problem
    exit unless defined $str;
    # Try matches until we find one that works, then start over.
    for my $pat (@pats) {
        next WORD if $str =~ /$pat/;
    }
    # If it won't match anything, print it.
    print $_;
}

:~/nmap$ history | grep json
 2152  wget https://scans.io/data/rapid7/sonar.cio/critical_201205_22.json.bz2
 2162  bunzip2 <critical_201205_22.json.bz2 | python extract.py critical_201205_22.json | ../other/JohnTheRipper/run/unique banners

("unique" is equivalent to (but faster than) "sort -u" without the sorting)