{"id":13582117,"url":"https://github.com/stanford-esrg/lzr","last_synced_at":"2025-04-04T09:06:55.708Z","repository":{"id":38466568,"uuid":"242851493","full_name":"stanford-esrg/lzr","owner":"stanford-esrg","description":"LZR quickly detects and fingerprints unexpected services running on unexpected ports.","archived":false,"fork":false,"pushed_at":"2025-02-15T03:05:41.000Z","size":78958,"stargazers_count":169,"open_issues_count":11,"forks_count":40,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-28T08:05:01.816Z","etag":null,"topics":["go","golang","internet-wide-scanning","ipv4","network","port-scan","port-scanner","port-scanning","scanning","security","security-tools","zgrab","zmap"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stanford-esrg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-24T21:50:51.000Z","updated_at":"2025-03-24T06:33:14.000Z","dependencies_parsed_at":"2024-11-07T17:00:24.365Z","dependency_job_id":"df5d8b9e-5752-411f-8227-4b12d1c05c01","html_url":"https://github.com/stanford-esrg/lzr","commit_stats":{"total_commits":240,"total_committers":8,"mean_commits":30.0,"dds":"0.37916666666666665","last_synced_commit":"ebb409e7c0780e3c45a67d1e6650b602c2400551"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stanford-esrg%2Flzr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stanford-esrg%2Flzr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stanford-esrg%2Flzr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stanford-esrg%2Flzr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stanford-esrg","download_url":"https://codeload.github.com/stanford-esrg/lzr/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247149500,"owners_count":20891954,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","internet-wide-scanning","ipv4","network","port-scan","port-scanner","port-scanning","scanning","security","security-tools","zgrab","zmap"],"created_at":"2024-08-01T15:02:26.183Z","updated_at":"2025-04-04T09:06:55.689Z","avatar_url":"https://github.com/stanford-esrg.png","language":"Go","funding_links":[],"categories":["Go","Related Lists"],"sub_categories":[],"readme":"LZR\n=========\n\nLZR quickly detects and fingerprints unexpected services running on unexpected ports by working with [ZMap](https://github.com/zmap/zmap). LZR can detect up to 18 unique protocols simultaneously with just two extra packets and can fingerprint over 35 different protocols. \n\nTo learn more about LZR's system and performance, check out the original [paper](https://lizizhikevich.github.io/assets/papers/lzr.pdf) appearing at [USENIX Security '21](https://www.usenix.org/conference/usenixsecurity21). To use LZR to fingerprint services across all 65K ports, check out [GPS](https://github.com/stanford-esrg/gps).  \n\n## Building\n\nInstall and set up [ZMap](https://github.com/zmap/zmap). If also performing full L7 handshakes, set up [ZGrab](https://github.com/zmap/zgrab2).\n\nSet up `$GOPATH` (see https://golang.org/doc/code.html).\n```\n$ go get github.com/stanford-esrg/lzr\n$ cd $GOPATH/src/github.com/stanford-esrg/lzr\n```\n\nLZR intercepts connections which ZMap opens; in order to ensure that the kernel does not interfere with LZR, LZR requires a source-ip to be specified for which the kernel drops all RSTs for traffic targeted to the source-ip. The chosen source-ip\u0026mdash;which both ZMap and LZR will use\u0026mdash;should be passed in as a parameter to make, so the appropriate iptables rule can be set.\n```\n$ make all source-ip=256.256.256.256/32\n```\n\n## Usage\n\nTo fingerprint unexpected services on an random port (9002):\n\n```\nsudo zmap --target-port=9002 --output-filter=\"success = 1 \u0026\u0026 repeat = 0\" \\\n-f \"saddr,daddr,sport,dport,seqnum,acknum,window\" -O json --source-ip=$source-ip | \\\nsudo ./lzr --handshakes http,tls\n```\n\nTo complete full L7 handshakes of unexpected services on an random port (9002), substitute ``port=x`` in ``etc/all.ini`` with ``port=9002`` and run the following command:\n\n```\nsudo zmap --target-port=9002 --output-filter=\"success = 1 \u0026\u0026 repeat = 0\" \\\n-f \"saddr,daddr,sport,dport,seqnum,acknum,window\" -O json --source-ip=$source-ip | \\\nsudo ./lzr --handshakes wait,http,tls -feedZGrab | \\\nzgrab multiple -c etc/all.ini \n```\n\nTo scan a custom list of IP:Port (i.e., using LZR rather than ZMap to open connections):\n\n```\nsudo ./lzr --handshakes http -sendSYNs -sourceIP $source-ip -gatewayMac $gateway -rate $PACKETS_PER_SECOND \u003cservices_list\n```\n\nThe expected input format of an example services list is:\n```\n1.1.1.1:1234\n2.2.2.2:80\n```\n\nTo scan a sample of IP:Port from ZMap's dryrun option (i.e., ZMap still determines which IP:Port we use but LZR opens the connection):\n```\nsudo zmap --target-port=9002 -O - --source-ip=$source-ip --dryrun | sudo ./lzr --handshakes http -dryrun -sourceIP $source-ip -gatewayMac $gateway\n```\n\n## Flags\n```\n$ ./lzr --help\n\nUsage of ./lzr:\n  -cpuprofile string\n    \twrite cpu profile to file\n  -d\tdebug printing on\n  -f string\n    \tjson results output file name (default \"default_20210227212802.json\")\n  -feedZGrab\n    \tsend to zgrab ip and fingerprint\n  -forceAllHandshakes\n    \tComplete all handshakes even if data is returned early on. This also turns off HyperACKtive filtering.\n  -gatewayMac string\n    \tgateway Mac Address in format xx:xx:xx:xx:xx:xx\n  -haf int\n    \tnumber of random ephemeral probes to send to filter ACKing firewalls\n  -handshakes string\n    \thandshakes to scan with (default \"http\")\n  -memprofile string\n    \twrite memory profile to this file\n  -priorityFingerprint string\n    \tfingerprint to prioritize when multiple match\n  -pushDataOnly\n    \tDon't attach data to ack but rather to push only\n  -rn int\n    \tnumber of data packets to re-transmit (default 1)\n  -rt int\n    \tnumber of seconds until re-transmitting packet (default 1)\n  -sendInterface string\n    \tnetwork interface to send packets on (default \"ens8\")\n  -sendSYNs\n    \twill read input from stdin containing a newline-delimited list of ip:port\n  -dryrun\n      will read output from ZMap's \"dryrun\" mode (activates sendSYNs by default)\n  -sourceIP string\n    \tsource IP to send syn packets with (if using sendSYNs flag)\n  -t int\n    \tnumber of seconds to wait in timeout queue for last retransmission (default 5)\n  -w int\n    \tnumber of worker threads for each channel (default 1)\n  -rate int\n        number of IP:ports piped in per second if using sendSYNs\n```\n\n#### Caveats for specific features\nAcking Firewall Filtering (-haf): If a host responds both on the expected port and on the random ephemeral port, whichever response comes first will dictate whether the host is marked as having an ACKing firewall. \n\n## LZR's Algorithm\n\n![](etc/LZRFlow.png)\n\n## License and Copyright\n\nCopyright 2020 The Board of Trustees of The Leland Stanford Junior University\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstanford-esrg%2Flzr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstanford-esrg%2Flzr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstanford-esrg%2Flzr/lists"}