sybase

Documentation

Overview

Package sybase implements fingerprinting for Sybase ASE (Adaptive Server Enterprise), now known as SAP ASE.

Sybase ASE uses the Tabular Data Stream (TDS) protocol version 5.0 for client-server communication. While Microsoft SQL Server also uses TDS, Sybase's TDS 5.0 is not compatible with Microsoft's TDS 7.x+ implementation.

Detection Strategy: - Send TDS pre-login packet (similar to MSSQL) - Validate TDS 5.0 response structure - Check for Sybase/ASE markers in version string - Differentiate from MSSQL via product identification

Version Detection: - Extract version from TDS handshake VERSION option token - Parse formats: "Adaptive Server Enterprise/{version}" or "Sybase SQL Server/{version}" - Support Service Pack notation: "16.0 SP03" → "16.0.3"

CPE Generation: - Vendor: sap (SAP acquired Sybase in 2010) - Product: adaptive_server_enterprise - Version: Extracted from handshake or "*" for unknown

Index

• Constants
• type Data
  • func DetectSybase(conn net.Conn, timeout time.Duration) (Data, bool, error)
• type OptionToken
• type SybasePlugin
  • func (p *SybasePlugin) Name() string
  • func (p *SybasePlugin) PortPriority(port uint16) bool
  • func (p *SybasePlugin) Priority() int
  • func (p *SybasePlugin) Run(conn net.Conn, timeout time.Duration, target plugins.Target) (*plugins.Service, error)
  • func (p *SybasePlugin) Type() plugins.Protocol

Constants

const (
	VERSION         uint32 = 0
	ENCRYPTION      uint32 = 1
	INSTOPT         uint32 = 2
	THREADID        uint32 = 3
	MARS            uint32 = 4
	TRACEID         uint32 = 5
	FEDAUTHREQUIRED uint32 = 6
	NONCEOPT        uint32 = 7
	TERMINATOR      byte   = 0xFF
)

TDS Option Token Constants

const (
	SYBASE       = "sybase"
	DEFAULT_PORT = 5000
)

Protocol constants

Types

type Data

type Data struct {
	Version string
}

Data holds version information extracted from Sybase ASE

func DetectSybase

func DetectSybase(conn net.Conn, timeout time.Duration) (Data, bool, error)

DetectSybase sends a TDS pre-login packet and validates the Sybase ASE response

type OptionToken

type OptionToken struct {
	PLOptionToken  uint32
	PLOffset       uint32
	PLOptionLength uint32
	PLOptionData   []byte
}

OptionToken represents a TDS option token from pre-login response

type SybasePlugin

type SybasePlugin struct{}

SybasePlugin implements the Plugin interface for Sybase ASE fingerprinting

func (*SybasePlugin) Name

func (p *SybasePlugin) Name() string

Name returns the protocol name for Sybase ASE

func (*SybasePlugin) PortPriority

func (p *SybasePlugin) PortPriority(port uint16) bool

PortPriority returns true if the port is the default Sybase ASE port (5000)

func (*SybasePlugin) Priority

func (p *SybasePlugin) Priority() int

Priority returns the execution priority (145 = after MSSQL 143, before generic)

func (*SybasePlugin) Run

func (p *SybasePlugin) Run(conn net.Conn, timeout time.Duration, target plugins.Target) (*plugins.Service, error)

Run executes the Sybase ASE fingerprinting logic

func (*SybasePlugin) Type

func (p *SybasePlugin) Type() plugins.Protocol

Type returns the protocol type (TCP)