#
# Configuration file for saint; limits, policies, etc. go here
#
#
# version 1, Mon Mar 20 19:16:55 1995, last mod by wietse
#

#
# NOTE - "" or 0 means false, in this config file
#

# Where do we keep the data? This is just a default.
# Directory will be created under "results" unless full path is specified.
$saint_data = "saint-data";

# Default attack level (0=light, 1=normal, 2=heavy, 3=heavy+,
# 4=top20, 5=custom).
$attack_level = 2;

# Number of passwords to guess for each account.
# Greater than 2 will lock out accounts on some systems.
# 0 disables password guessing.
$password_guesses = 2;

# Default input string for tcp_scan
$input_tcp_scan = 'QUIT\\r\\n';
$input_tcp_plus = 'USER saint\\r\\nNICK q\\r\\nQUIT\\r\\n';

# Probes by attack level.
#
# ? Means conditional, proposed by rules.todo.
# With heavy scans, replace 1-9999 by 1-65535 to find all non-standard
# telnet, ftp, www or gopher servers.
# UDP ports to scan have been re-arranged to put more important
# ones first. You may need to increase $udpscan_timeout
# below if you want to scan them all.

@light = (
	'dns.saint',
	'ostype.saint',
	'rpc.saint',
	'showmount.saint?',
	);

@top20 = (
	'dns.saint',
	'ostype.saint',
	'rpc.saint',
	'tcpscan.saint 21,23,25,53,79,80,135-139,443,445,512-515',
	'udpscan.saint 53,135-139,161,162',
	'finger.saint?',
	'rusers.saint?',
	'login.saint?',
	'win_login.saint?',
	'mountd.saint?',
	'dns-chk.saint?',
	'http.saint?',
	'smb.saint?',
	'snmp.saint?',
	'statd.saint?',
	'cmsd.saint?',
	'tooltalk.saint?',
	'sadmind.saint?',
	'snmpxdmid.saint?',
	'yppasswdd.saint?',
	'walld.saint?',
	'registry.saint?',
	'sendmail.saint?',
	'rsh.saint?',
	'rlogin.saint?',
	'rexec.saint?',
	'printer.saint?',
	'ypbind-chk.saint?',
	'cachefsd.saint?',
	);

@normal = (
	@light, 
	'finger.saint?', 
	'tcpscan.saint 70,79,80,ftp,telnet,smtp,nntp,uucp,6000', 
	'udpscan.saint 53,177',
	'rusers.saint?', 
	'boot.saint?',
	'yp-chk.saint?',
	'sadmind.saint?',
	'tooltalk.saint?',
	'cmsd.saint?',
	'walld.saint?',
	'ypbind-chk.saint?',
	'cachefsd.saint?',
	);

@heavy= (
	@light,
	'ddos.saint',
	'adore.saint',
        $heavy_tcp_scan = 'tcpscan.saint 10008,12754,15104,16660,20432,27374,27665,32766,33270,33567,33568,42800,60008,1-1102,1104-1525,1527-5404,5406-10000',
        $heavy_udp_scan = 'udpscan.saint 1-19,53,67-69,111,123,137-139,161-162,177,1812,1900,5135,8999,20-52,54-66,70-110,112-122,124-136,140-160,163-176,178-1760,1763-1811,1813-1899,1901-2050,32767-33500',
        '*?',
        );
	$heavy_tcp_scan_old = $heavy_tcp_scan;
	$heavy_udp_scan_old = $heavy_udp_scan;

@heavyplus= (
	@light,
	'ddos.saint',
	'adore.saint',
	$heavyplus_tcp_scan = 'tcpscan.saint 10008,12754,15104,16660,20432,27374,27665,32766,33270,33567,33568,42800,60008,1-10000',
	$heavyplus_udp_scan = 'udpscan.saint 1-19,53,67-69,111,123,137-139,161-162,177,1812,1900,5135,8999,20-52,54-66,70-110,112-122,124-136,140-160,163-176,178-1760,1763-1811,1813-1899,1901-2050,32767-33500',
	'*?',
	);

# Custom attack levels
@custom = ();

# List of the user-defined scan levels
@custom_levels = ("custom");

# Currently selected custom scan level, from the list above
$custom_level = "custom";

# status file; keeps track of what SAINT is doing.
$status_file = "status_file";

# Do we want to read in a list of targets from a file? (0=no; 1=yes)
$use_target_file = 0;

# File name of target list (used if previous variable is 1)
$target_file = "target_file";

#
# timeout values. -t option chooses one of these.
#
$short_timeout = 10;
$med_timeout = 20;
$long_timeout = 60;

# which timeout to use (0=short, 1=med, 2=long)
$timeout = 1;

# maximum number of concurrent probes (set to 1 to disable multitasking)
# Memory required is proportional to the number of threads. Don't make
# this too high.
$maximum_threads = 5;

#
#  Three new parameters for working in firewall environment
#  fw_timeout		No. of seconds before dropping connection request
#  fw_loadlimit		Max No. of concurrent connection requests
#  fw__tcp_scan		~ (10000 * fw_timeout)/fw_loadlimit
#
#  I'm using a low limit now because of slow machine over ppp
#

$fw_timeout = 5;
$fw_loadlimit = 20;
$fw_tcp_scan = 1000;

#
# Some tools need more time, as specified in these variables
#
$nfs_chk_timeout = $long_timeout;
$tcpscan_timeout = $long_timeout;
$udpscan_timeout = $long_timeout;
$snmp_timeout = 150;
$smurf_timeout = $long_timeout;
$http_timeout = 120;
$smb_timeout = $long_timeout;
$finger_timeout = $long_timeout;
$win_login_timeout = $long_timeout;
$telnet_timeout = $long_timeout;

# what signal we send to nuke things when they timeout:
$timeout_kill = 9;

#
# Proximity variables; how far out do we attack, does severity go down, etc.
#
# How far out from the original target do we attack? Zero means that we only
# look at the hosts or network that you specify. One means look at neighboring
# hosts, too. Anything over two is asking for problems, unless you are on the
# inside of a firewall.
$max_proximity_level = 0;

# Attack level drops by this much each proximity level change
# (only used with light, medium, heavy, and heavy+ levels)
$proximity_descent = 1;

# when we go below zero attack, do we stop (0) or go on (1)?
$sub_zero_proximity = 0;

# a question; do we attack subnets when we nuke a target?
# 0 = no; 1 = primary target subnet
# Choosing no will also disable broadcast probes (e.g. smurf)
$attack_proximate_subnets = 0;

#
# Does SAINT run on an untrusted host? (0=no; 1=yes, this host does not appear
# in the rhosts, hosts.equiv or NFS export files of hosts that are being
# probed).
#
$untrusted_host = 1;

#
# Any exceptions on who we want to hit?  E.g., stay away from the mil sites?
# Also, you can specify *only* hit sites of a certain type; e.g. edu sites.
#

#
# If $only_attack_these is non-null, *only* hit sites if they are of this
# type.  You can specify a domain (podunk.edu) or network number
# (192.9.9). You can specify a list of shell-like patterns with domains
# or networks, separated by whitespace or commas.
#
# Examples:
#
# $only_attack_these = "podunk.edu";
# $only_attack_these = "192.9.9";
# $only_attack_these = "podunk.edu, 192.9.9";
#
$only_attack_these = "";

#
# Stay away from anyone that matches these patterns.
#
#  Example - leave government and military sites alone:
#
# $dont_attack_these = "gov, mil";
$dont_attack_these = "";

#
# Assume targets have the following netmask(s).
# Change this if targets use unusual subnetting.
# Used for smurf test.
# Be very careful if you go below this (e.g. 255.255.254.0),
# or you might scan a different Class C network.
$target_netmask = "255.255.255.0,255.255.255.128,255.255.255.192";

#
# Remote mode (0=no, 1=yes)
#
$remote_mode = 0;

#
# Only allow these hosts to connect
# (space-separated list of IP addresses, use * for wildcard)
#
$allow_hosts = "";

#
# Port for server to use in remote mode
#
$server_port = 1414;

#
# Whether to skip the password prompt in remote mode
#
$skip_passwd = 0;

#
# Set the following to your own IP address
# if SAINT fails to look up your host
#
$my_address = "";

#
# Whether to interface with an existing web server instead
# of listening on a port (be sure to install scripts/saint.cgi
# in the CGI directory)
#
$web_server = 0;

#
# Named pipes to use for communication between SAINT and
# web server when $web_server = 1. $query_pipe will be
# created in saint directory and $response_pipe under /tmp.
#
$query_pipe = ".saint_query";
$response_pipe = ".saint_response";

# Domain administrator's login name. This is needed for
# some Windows checks. (Do not put password here. Password
# resides in memory only.)
$domain_user = "";

# Whether to perform dangerous scans
# (0 = no, 1 = yes)
# Caution! "yes" could crash services on targets
$extreme = 0;

#
# Set the following to one if DNS (internet name service) is unavailable.
# (0 = use nslookup, 1 = don't use nslookup)
#
$dont_use_nslookup = 1;

#
# Should SAINT ping hosts to see if they are alive (disable for firewall env)?
# (0 = ping hosts, 1 = don't ping hosts)
#
$dont_use_ping = 0;
#
# No firewall environment (0) or expect a firewall (1)
#
$firewall_flag = 0;

#
# TCP ports to scan to find live hosts
# if $dont_use_ping or $firewall_flag are set.
$std_ports = "25,53,80,139,143";

1;
