                   _                           ____
             _ __ (_)_ __  _ __   ___ _ __    / ->/|
            | '_ \| | '_ \| '_ \ / _ \ '__|  /<-_/ |
            | | | | | |_) | |_) |  __/ |     |   | /
            |_| |_|_| .__/| .__/ \___|_|     |___|/
                    |_|   |_|

                        Version 0.10.0
                by Ian Ventura-Whiting (Fizz)


nipper is a Network Infrastructure Configuration Parser. nipper takes
a network infrastructure device configuration, processes the file and
details security-related issues with the configuration together with
detailed recommendations. nipper was previous known as CiscoParse.

nipper currently supports Cisco switches (IOS), Cisco Routers (IOS),
Cisco Catalyst devices (IOS/CatOS/NMP), Cisco Firewalls (PIX/ASA/FWSM),
Cisco Content Services Switch (CSS) and Juniper NetScreen (ScreenOS).
Output from nipper is in HTML, Latex, XML and Text. Additionally, nipper
will reverse any Cisco type-7 passwords, any other encrypted passwords
can be output to a John-the-Ripper file for further testing.
By default, input is retrieved from stdin and is output (in HTML format)
to stdout.

Command:

    nipper [Options]

General Options:

    --help
    Displays this command line help and overrides all other options.

    --input=<file>
    Specifies a device configuration file to be processed.

    --output=<file> | --report=<file>
    Specified an output file for the report.

    --version
    Displays the program version.

Network Infrastructure Device Type Options:

    Different types of network infrastructure devices have different
    configuration file structures and default options.

    --pix | --asa | --fwsm
    Treat input configuration as a PIX/ASA/FWSM-based Cisco firewall.

    --ios | --ios-router
    Treat input configuration as a IOS-based Cisco router. This is the
    default device type.

    --ios-switch
    Treat input configuration as a IOS-based Cisco switch.

    --ios-catalyst
    Treat input configuration as a IOS-based Cisco catalyst.

    --catos | --nmp
    Treat input configuration as a CatOS- or NMP-based Cisco Catalyst.

    --css
    Treat input configuration as a Cisco Content Services Switch.

    --netscreen | --screenos
    Treat input configuration as a ScreenOS-based Juniper Netscreen
    firewall device.

Network Infrastructure Device Usage Options:

    Different types of network infrastructure devices have different
    uses within a network infrastructure. By default nipper will not
    treat the device as if it has a particular use.

    --edge
    Treat the device as a network infrastructure edge device.

    --internal
    Treat the device as an internal network infrastructure device.

General Report Options:

    By default a report will include a security audit section which
    includes any identified security-related issues, their impact and
    recommendations. Additionally, it will include a device configuration
    section and an appendix section.

    --output-format=<format> | --report-format=<format>
    Defines the output format produced by nipper. Valid formats are:
    "html", "latex", "text" and "xml". The default is html.

    --no-audit
    This option disables the security audit of the device configuration.

    --no-names
    Convert host / network names to IP addresses where possible.

    --expand-acl
    Expand an Access Control Lists / Filtering object definitions. This
    option will show the reality of a filtering policy.

    --device-name=<name>
    If a device configuration file does not contain a device name, it
    can be specified using this option.

    --company-name=<name>
    Replace the 'nipper recommends...' in the report output to something
    else. So for the Acme company, it would read, 'Acme recommends...'.

Appendix Report Options:

    These options allow for the customisation of the reports appendix
    section. However, not all these report sections may appear in your
    report. Appendix sections are custom generated for each configuration.

    --no-appendix
    Disables the output of the entire report appendix section. By default an
    appendix section is generated and added to the report.

    --no-abbreviations
    Disables the output of an abbreviations section in the appendix.

    --no-logging
    Disables the output of the logging levels section in the appendix.

    --no-timezones
    Disables the output of the time zones section in the appendix.

    --no-ports
    Disables the output of a common ports section in the appendix.

    --no-version
    Disables the output of the nipper version section in the appendix.

Report Format Options:

    --stylesheet=<file>
    Supply an external Cascading Style Sheet (CSS) for use with the HTML
    -based reports. If this option is not supplied a default CSS is
    embeded. The supplied CSS file will be embeded within the report
    output.

    --paper=<Latex paper size>
    This option can be used to configure the Latex document paper size.
    The default paper size is 'a4paper'. Refer to the Latex documentation
    for other settings.

    --documentclass=<Latex document class>
    This option can be used to configure the Latex document class. The
    default document class is 'article'. Refer to the Latex documentation
    for other settings.

Security Audit Network Filtering Options:

    --strict-source
    Check for filtering from any source.

    --no-deny-log
    Prevents checking for filtering not ending with a deny all and
    log.

Security Audit Password Options:

    Password strength and dictionary-based testing is performed on all
    authentication systems. Therefore, in addition to user passwords,
    SNMP community strings and keys are also checked.

    --no-passwords
    Removes passwords from the output. However, passwords are always
    checked against defaults and for password strength.

    --john=<file>
    Output the Cisco type 5 passwords in a file that can then be run
    through john-the-ripper.

    --dictionary=<file>
    Use a dictionary file to check the passwords and keys are not
    dictionary-based words. If this option is not specified a small
    number of built-in passwords are used instead. This option is
    not used to break MD5 passwords, only compare passwords already
    known.

    --pass-length=<length>
    Password strength checks will check that retrieved passwords have
    a minimum length as specified. The default is 8 characters.

    --pass-uppers=<yes|no>
    Password strength checks will check that retrieved passwords must
    include uppercase characters. The default is no.

    --pass-lowers=<yes|no>
    Password strength checks will check that retrieved passwords must
    include lowercase characters. The default is no.

    --pass-either=<yes|no>
    Password strength checks will check that retrieved passwords must
    include upper or lowercase characters. The default is yes.

    --pass-numbers=<yes|no>
    Password strength checks will check that retrieved passwords must
    include numbers. The default is yes.

    --pass-specials=<yes|no>
    Password strength checks will check that retrieved passwords must
    include special characters. The default is no.

Security Audit Misc Options:

    --timeout=<seconds>
    Specify the number of seconds that connection timeouts should be
    less than or equal to. If timeouts are less than this, a security
    will be generated in the report. The default is 10 minutes.

Remote SNMP Config Retrival Options:

    These options allow the retrieval of a Cisco configuration file from
    the device itself. There are two methods of remote retrival; the first
    uses the old Cisco system MIB which works with devices upto IOS 12.x,
    the second method uses the new Cisco config copy MIB and works with
    devices running IOS 12.0 (some with 11.2P). Cisco Parse defaults to
    using the new Cisco system MIB.
    This feature requires a running TFTP server and the net-snmp package.
    Additionally, the IP address of the Cisco device and the local address
    need to be specified. You will need to be the root user.

    --cisco-ip=<ip address>
    Specify the IP address of the Cisco Device to retrieve the config from.

    --local-ip=<ip address>
    The IP address of the host making the request. This is essential for
    remote config retrival, else it will fail.

    --cisco=<old | new>
    There are two methods of retrieving the config remotely using SNMP. The
    old method is supported on Cisco devices upto IOS 12.x, the
    new method (default) is supported from IOS 12.0 (11.2P on some devices).

    --snmp=<community>
    The snmp community to be used with the above. A default of 'private'
    will be used if not specified.

    --tftproot=<directory>
    The tftp root directory to be used for the Cisco config transfer. If
    not specified a default of /tftproot/ will be used.

    --cisco-file=<filename>
    Specifies a filename for the Cisco config file to be saved to. If not
    specified, then the file will be left in the tftproot as a random file
    name.

Debug Options:

    --debug
    Outputs additional information that most users would not find very
    helpful, but is useful in understanding how the configuration is
    interpreted. Using the debug option overrides all other output.

    --debug-abbreviations
    Shows a list of all the abbreviations that were not processed. The
    list is output to stdout and lists the number of hits each entry
    has had. Not all of the items listed will be valid abbreviations.

    --debug-lnp
    Output the configuration lines not processed (to screen only).

Examples:

    nipper --pix --input=configIOS.txt --output=report.html
    Parses the PIX configuration file configPIX.txt and outputs the
    the HTML report to the report.html file.

    cat ios.config | nipper --company-name=Acme >report.html
    Parses the Cisco router configuration stored in ios.config and
    redirects the HTML report output to report.html. Nipper will
    also use the company name "Acme" in the report output.

    nipper --pass-length=12 --input=cisco.txt --output=report.htm
    Parses the configuration file stored in cisco.txt and outputs the
    report to report.htm. It will override the default password length
    check of 8 and checks for a miniumum password length of 12 chars.
