Powershell-Learning

Trial and error creation of powershell scripts to help with IR

Copied Scripts

The from others directory will hold any scripts which have been 100% lifted and shifted

QTS

This is designed to be a holder for various data collection tasks in support of IR

NMAP Parser

This is supposed to be a simple script for reading nmap/zenmap XML and converting it.

NMAP - Example XML Format

<nmaprun>
<hostcomment="">
<statusstate="up"></status>
<ipaddraddrtype="ipv4"vendor=""addr="10.1.1.1"></ipaddr>
<hostnames></hostnames>
<ports>
<portprotocol="tcp"portid="22">
<statereason="syn-ack"state="open"reason_ttl="250"></state>
<serviceproduct="Cisco SSH"name="ssh"extrainfo="protocol 2.0"version="1.25"conf="10"method="probed"></service>
</port>
<portprotocol="tcp"portid="53">
<statereason="reset"state="closed"reason_ttl="250"></state>
<servicemethod="table"conf="3"name="domain"></service>
</port>
<portprotocol="tcp"portid="135">
<statereason="reset"state="closed"reason_ttl="250"></state>
<servicemethod="table"conf="3"name="msrpc"></service>
</port>
<portprotocol="tcp"portid="445"><statereason="reset"state="closed"reason_ttl="250"></state>
<servicemethod="table"conf="3"name="microsoft-ds"></service>
</port>
</ports>
<os>
<portusedstate="open"portid="22"proto="tcp"></portused>
<portusedstate="closed"portid="53"proto="tcp"></portused>
<osmatch>
<osclass></osclass>
</osmatch>
</os>
<uptimelastboot=""seconds=""></uptime>
<tcpsequence></tcpsequence>
<ipidsequence></ipidsequence>
<tcptssequence></tcptssequence>
</host>
</nmaprun>

More to follow...