11 Aug 1999
payerle@physics.umd.edu

Added SNMP queries to SAINT (1.3.6):
	1) Tries to guess read and write community strings, and warns if
		can
	2) If given or can guess read community string, will use SNMP
		sysDesc to aid in identifying hosttype.

SNMP Libraries/ licensing:
	Uses with permission of author the Perl SNMP libraries created by 
	Simon Leinen <simon@switch.ch> and available from
	http://www.switch.ch/misc/leinen/snmp/perl/index.html
	The SNMP libraries (SNMP_Session.pm, SNMP_util.pm, and BER.pm)
	are covered under the Artistic License 
	(http://language.perl.com/misc/Artistic.html)

	Tom Payerle licenses all code he created/modified under standard
	SAINT license.


Changes added:

perl/hosttype.pl: Modified so that it will look at snmp records as well as
	telnet, ftp, smtp in identifying host via rules/hosttype.
	Also added a line to require severities.pl when run outside saint, as
	this was hanging up.

perllib/SNMP_Session.pm
	SNMP_util.pm
	BER.pm
	SNMP_Session.README : Simon Leinen's SNMP libraries for Perl

rules/todo: Modified to call snmp.saint (with write community guessing enabled)
	if host offers SNMP

config/saint.cf : added a 120 second timeout for snmp.saint

config/SNMP_communities.pl :
	New file.  Contains list of read community strings for specific hosts.
	So that SAINT can pick up SNMP sysDesc for device even if community
	string cannot be guessed.

html/tutorials/vulnerabilities/Guessable_Write_Community
				Guessable_Read_Community : blurb on why probably
					don't want guessable community strings

bin/snmp.saint : Actual probe code.  

README.SNMP: this file

Probe algorithm, etc:

The probe reads in the SNMP_communities.pl file.

If it is given the read community for a host, it connects with that string
and reads sysDesc.  If can't connect, it continues as if wasn't given the
read community string.  If string given and not told to ignore guessable strings
for that host, will complain if string is in the list of strings to guess.

If no read community string given, or it was wrong, it tries to guess it.  This
is currently done in a simple, brute force method, it tries everything on a
list, currently short (public, private, and null).  If it succeeds in 
connecting, it reads sysDesc for host-typing, and generates a warning.

If called with the "-w" flag, (current todo uses it), it will also try to guess
the write community string.  This is not only brutish but invasive (it tries
to connect, then to prove is a write community, resets sysLocation.  It will
try to set back to original if succeeds).  If it guesses a write community, 
warns about that as well.

Not elegant or efficient, but works (albeit requires somewhat large timeout
value if needs to guess).


