How do I awk or grep greppable Nmap output for IP address, Host, Port Number, Port Status, Protocol, Service, and Service Version (if there is one)? - awk

Question

The greppable Nmap output looks like the following:
Host: 9.2.1.100 (hello.world.com) Status: Up
Host: 9.2.1.100 (hello.world.com) Ports: 21/closed/tcp//ftp///, 22/closed/tcp//ssh///,
23/closed/tcp//telnet///, 25/closed/tcp//smtp///, 80/open/tcp//http//Citrix Metaframe ICA Browser/,
110/filtered/tcp//pop3///, 139/open/tcp//netbios-ssn//Microsoft Windows netbios-ssn/,
443/closed/tcp//https///, 445/open/tcp//microsoft-ds//Windows Server 2003 3790 Service Pack 2 microsoft-ds/,
3389/open/tcp//ms-wbt-server//Microsoft Terminal Service/ Seq Index: 256 IP ID Seq: Incremental
My question is how do I use awk or grep to parse the output so that I get the following:
IP Address, Host, Port Status (limited to only open ports), Protocol, Service, and Service Version (if there is one)?
9.2.1.100\thello.world.com\t80\topen\ttcp\thttp\tCitrix Metaframe ICA Browser\n
9.2.1.100\thello.world.com\t139\topen\ttcp\tnetbios-ssn\tMicrosoft Windows netbios-ssn\n
...

Answer 1

There are a million different ways to parse this output, and this is probably not the prettiest, but I do believe this should work:
grep 'Ports:' $1 | while read -r line
do
ip=$(echo $line | grep -oP '(?<=^Host: )(\d{1,3}\.){3}\d{1,3}')
name=$(echo $line | grep -Po "(?<=^Host: $ip \()[^\)]*")
echo "$line" | grep -Po '(?<=\tPorts: )[^\t]*\t' | sed -e 's/, /\n/g' | sed -e 's%/%\t%g' | cut -d/ -f 1-3,5,7 | sed -e "s/^/$ip\t$name\t/g"
done
in this specific example you have to save this code to a file and execute it with a the name of the file that contains the nmap output as an argument.
Anyway, here you can find the full explanation about the grepable output of the nmap command. They even explain how it should be parsed, but i did not have the time to read it so i just wrote here this little script.
I hope you will find this helpful.