amap

AMAP stands for Application MAPper. It is designed for pentesters to map applications running on arbitrary ports, distinguishing it from traditional port scanners by actively probing for application fingerprints. This is particularly useful when services are running on unexpected ports or when identifying obscure protocols.

The tool sends specially crafted trigger packets to target ports and matches the responses against a database of known signatures stored in files like appdefs.trig, appdefs.resp, and appdefs.rpc. It supports both TCP and UDP protocols and can handle IPv6 via the amap6 binary.

Common use cases include reconnaissance during penetration tests, service enumeration beyond basic banner grabbing, and identifying services that don't respond to standard probes. Recommended options like -bqv provide banners, quiet output, and verbosity for effective scanning.

AMAP operates by loading trigger definitions from /etc/amap/appdefs.trig (30 triggers), response signatures from /etc/amap/appdefs.resp (346 responses), and RPC triggers from /etc/amap/appdefs.rpc (450 triggers). In default -A mode, it sends trigger packets to target ports and analyzes responses to match against known application signatures. For banner grabbing (-B), it simply captures service banners without triggers. It supports plain connect mode for port scanning (-P) and can process Nmap output files (-i). UDP mode (-u), IPv6 (-6), and various optimizations like single-trigger (-1) enhance its flexibility.