Home page logo
/
Zenmap screenshot
Intro Reference Guide Book Install Guide
Download Changelog Zenmap GUI Docs
Bug Reports OS Detection Propaganda Related Projects
In the Movies In the News
Example Nmap output

File dicom-ping

Script types: portrule
Categories: discovery, default, safe, auth
Download: https://svn.nmap.org/nmap/scripts/dicom-ping.nse

User Summary

Attempts to discover DICOM servers (DICOM Service Provider) through a partial C-ECHO request. It also detects if the server allows any called Application Entity Title or not.

The script responds with the message "Called AET check enabled" when the association request is rejected due configuration. This value can be bruteforced.

C-ECHO requests are commonly known as DICOM ping as they are used to test connectivity. Normally, a 'DICOM ping' is formed as follows:

  • Client -> A-ASSOCIATE request -> Server
  • Server -> A-ASSOCIATE ACCEPT/REJECT -> Client
  • Client -> C-ECHO request -> Server
  • Server -> C-ECHO response -> Client
  • Client -> A-RELEASE request -> Server
  • Server -> A-RELEASE response -> Client

For this script we only send the A-ASSOCIATE request and look for the success code in the response as it seems to be a reliable way of detecting DICOM servers.

Example Usage

  • nmap -p4242 --script dicom-ping <target>
  • nmap -sV --script dicom-ping <target>
    

Script Output

PORT     STATE SERVICE REASON
4242/tcp open  dicom   syn-ack
| dicom-ping: 
|   dicom: DICOM Service Provider discovered!
|_  config: Called AET check enabled

Requires


Author:

  • Paulino Calderon <calderon()calderonpale.com>

License: Same as Nmap--See http://nmap.org/book/man-legal.html

Nmap Site Navigation

Intro Reference Guide Book Install Guide
Download Changelog Zenmap GUI Docs
Bug Reports OS Detection Propaganda Related Projects
In the Movies In the News
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]