Nmap dicom-ping NSE Script
This page contains detailed information about how to use the dicom-ping NSE script. For list of all NSE scripts, visit the Nmap NSE Library.
Select: |
---|
Script Overview
Script source code: https://github.com/nmap/nmap/tree/master/scripts/dicom-ping.nse
Script categories: discovery, default, safe, auth
Target service / protocol: dicom, tcp
Target network port(s): 104, 2345, 2761, 2762, 4242, 11112
List of CVEs: -
Script Description
The dicom-ping.nse script attempts to discover DICOM servers (DICOM Service Provider) through a partial C-ECHO request. It also detects if the server allows any called Application Entity Title or not.
The script responds with the message "Called AET check enabled" when the association request is rejected due configuration. This value can be bruteforced.
C-ECHO requests are commonly known as DICOM ping as they are used to test connectivity. Normally, a 'DICOM ping' is formed as follows:
- Client -> A-ASSOCIATE request -> Server
- Server -> A-ASSOCIATE ACCEPT/REJECT -> Client
- Client -> C-ECHO request -> Server
- Server -> C-ECHO response -> Client
- Client -> A-RELEASE request -> Server
- Server -> A-RELEASE response -> Client
For this script we only send the A-ASSOCIATE request and look for the success code in the response as it seems to be a reliable way of detecting DICOM servers.
Dicom-ping NSE Script Arguments
This is a full list of arguments supported by the dicom-ping.nse script:
dicom.called_aetCalled Application Entity Title. Default: ANY-SCP
dicom.calling_aetCalling Application Entity Title. Default: ECHOSCU
- - -
To use these script arguments, add them to the Nmap command line using the --script-args arg1=value,[arg2=value,..]
syntax. For example:
nmap --script=dicom-ping --script-args dicom.called_aet=value,dicom.calling_aet=value <target>
Dicom-ping NSE Script Example Usage
Here's an example of how to use the dicom-ping.nse script:
nmap -p4242 --script dicom-ping <target>
nmap -sV --script dicom-ping <target>
Dicom-ping NSE Script Example Output
Here's a sample output from the dicom-ping.nse script:
PORT STATE SERVICE REASON
4242/tcp open dicom syn-ack
| dicom-ping:
| dicom: DICOM Service Provider discovered!
|_ config: Called AET check enabled
Dicom-ping NSE Script Example XML Output
Here's a sample XML output from the dicom-ping.nse script produced by providing the -oX <file>
Nmap option:
<script id="dicom-ping" output="
 dicom: DICOM Service Provider discovered!

config: Called AET check enabled"><elem key="dicom">DICOM Service Provider discovered!</elem>
<elem key="config">Called AET check enabled</elem>
</script>
Author
- Paulino Calderon <calderon()calderonpale.com>
References
- https://nmap.org/nsedoc/scripts/dicom-ping.html
- https://github.com/nmap/nmap/tree/master/scripts/dicom-ping.nse
See Also
Related NSE scripts to the dicom-ping.nse script:
Visit Nmap NSE Library for more scripts.
The dicom-ping.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.
Association failed:%s
Here is a relevant code snippet related to the "Association failed:%s" error message:
49:
50: action = function(host, port)
51: local output = stdnse.output_table()
52: local dcm_conn_status, err = dicom.associate(host, port)
53: if dcm_conn_status == false then
54: stdnse.debug1("Association failed:%s", err)
55: if err == "ASSOCIATE REJECT received" then
56: port.version.name = "dicom"
57: nmap.set_port_version(host, port)
58:
59: output.dicom = "DICOM Service Provider discovered!"
Version
This page has been created based on Nmap version 7.92.
Go back to menu.