mirror of
https://github.com/nmap/nmap.git
synced 2026-01-04 13:49:03 +00:00
Lua 5.2 upgrade [1] for NSE.
[1] http://seclists.org/nmap-dev/2012/q2/34
This commit is contained in:
@@ -1,3 +1,10 @@
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Retrieves information from a listening acarsd daemon. Acarsd decodes
|
||||
ACARS (Aircraft Communication Addressing and Reporting System) data in
|
||||
@@ -37,9 +44,6 @@ author = "Brendan Coles"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe","discovery"}
|
||||
|
||||
require("stdnse")
|
||||
require("comm")
|
||||
require("shortport")
|
||||
|
||||
portrule = shortport.port_or_service (2202, "acarsd", {"tcp"})
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bit = require "bit"
|
||||
local datafiles = require "datafiles"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Shows extra information about IPv6 addresses, such as embedded MAC or IPv4 addresses when available.
|
||||
|
||||
@@ -60,9 +66,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"default", "safe"}
|
||||
|
||||
require("bit")
|
||||
require("datafiles")
|
||||
require("stdnse")
|
||||
|
||||
hostrule = function(host)
|
||||
return true
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local afp = require "afp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local unpwdb = require "unpwdb"
|
||||
|
||||
description = [[
|
||||
Performs password guessing against Apple Filing Protocol (AFP).
|
||||
]]
|
||||
@@ -28,10 +36,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'afp'
|
||||
require 'unpwdb'
|
||||
|
||||
-- Version 0.3
|
||||
-- Created 01/15/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local afp = require "afp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to get useful information about files from AFP volumes.
|
||||
The output is intended to resemble the output of <code>ls</code>.
|
||||
@@ -53,10 +60,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'afp'
|
||||
require 'tab'
|
||||
|
||||
dependencies = {"afp-brute"}
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local afp = require "afp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local vulns = require "vulns"
|
||||
|
||||
description = [[
|
||||
Detects the Mac OS X AFP directory traversal vulnerability, CVE-2010-0533.
|
||||
|
||||
@@ -61,10 +68,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"exploit", "intrusive", "vuln"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'afp'
|
||||
require 'vulns'
|
||||
|
||||
dependencies = {"afp-brute"}
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local afp = require "afp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Shows AFP server information. This information includes the server's
|
||||
hostname, IPv4 and IPv6 addresses, and hardware type (for example
|
||||
@@ -41,10 +48,6 @@ author = "Andrew Orr"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'afp'
|
||||
require 'bit'
|
||||
|
||||
portrule = shortport.portnumber(548, "tcp")
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local afp = require "afp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Shows AFP shares and ACLs.
|
||||
]]
|
||||
@@ -32,9 +38,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'afp'
|
||||
|
||||
dependencies = {"afp-brute"}
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local ajp = require "ajp"
|
||||
local http = require "http"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Retrieves the authentication scheme and realm of an AJP service that requires
|
||||
authentication.
|
||||
@@ -20,9 +26,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "auth", "safe"}
|
||||
|
||||
local ajp = require('ajp')
|
||||
local http = require('http')
|
||||
local shortport = require('shortport')
|
||||
|
||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local ajp = require "ajp"
|
||||
local base64 = require "base64"
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local http = require "http"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Performs brute force passwords auditing against the Apache JServ protocol.
|
||||
The Apache JServ Protocol is commonly used by web servers to communicate with
|
||||
@@ -22,11 +30,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
local shortport = require('shortport')
|
||||
local ajp = require('ajp')
|
||||
local base64 = require('base64')
|
||||
local brute = require('brute')
|
||||
local http = require('http')
|
||||
|
||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||
|
||||
@@ -106,4 +109,4 @@ action = function(host, port)
|
||||
if ( status ) then
|
||||
return result
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local ajp = require "ajp"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Performs a HEAD or GET request against either the root directory or any
|
||||
optional directory and returns the server response headers.
|
||||
@@ -18,8 +22,6 @@ optional directory and returns the server response headers.
|
||||
--
|
||||
-- @args ajp-headers.path The path to request, such as <code>/index.php</code>. Default <code>/</code>.
|
||||
|
||||
local ajp = require('ajp')
|
||||
local shortport = require('shortport')
|
||||
|
||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||
|
||||
@@ -43,4 +45,4 @@ action = function(host, port)
|
||||
return fail("Failed to retrieve server headers")
|
||||
end
|
||||
return stdnse.format_output(true, response.rawheaders)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local ajp = require "ajp"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Finds out what options are supported by the AJP server by sending an OPTIONS
|
||||
request and lists potentially risky methods.
|
||||
@@ -29,8 +34,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "safe"}
|
||||
|
||||
local ajp = require('ajp')
|
||||
local shortport = require('shortport')
|
||||
|
||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||
|
||||
@@ -77,4 +80,4 @@ action = function(host, port)
|
||||
table.insert(output, "See http://nmap.org/nsedoc/scripts/ajp-methods.html")
|
||||
end
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local ajp = require "ajp"
|
||||
local io = require "io"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Request an URI over the Apache JServe Protocol and displays or alternatively
|
||||
stores the result in a file. Different AJP methods such as; GET, HEAD, TRACE,
|
||||
@@ -38,9 +43,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
local shortport = require('shortport')
|
||||
local packet = require('packet')
|
||||
local ajp = require('ajp')
|
||||
|
||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local amqp = require "amqp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Gathers information (a list of all server properties) from an AMQP (advanced message queuing protocol) server.
|
||||
|
||||
@@ -33,9 +38,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"default", "discovery", "safe", "version"}
|
||||
|
||||
require("stdnse")
|
||||
require("shortport")
|
||||
require("amqp")
|
||||
|
||||
portrule = shortport.port_or_service(5672, "amqp", "tcp", "open")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local dns = require "dns"
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Maps IP addresses to autonomous system (AS) numbers.
|
||||
|
||||
@@ -36,10 +43,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "external", "safe"}
|
||||
|
||||
|
||||
local dns = require "dns"
|
||||
local comm = require "comm"
|
||||
local ipOps = require "ipOps"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
|
||||
local mutex = nmap.mutex( "ASN" )
|
||||
@@ -333,9 +336,9 @@ function process_answers( records, output, ip )
|
||||
elseif combined_records[record.cache_bgp].asn_type ~= record.asn_type then
|
||||
-- origin before peer.
|
||||
if record.asn_type == "Origin" then
|
||||
combined_records[record.cache_bgp].asn = { unpack( record.asn ), unpack( combined_records[record.cache_bgp].asn ) }
|
||||
combined_records[record.cache_bgp].asn = { table.unpack( record.asn ), table.unpack( combined_records[record.cache_bgp].asn ) }
|
||||
else
|
||||
combined_records[record.cache_bgp].asn = { unpack( combined_records[record.cache_bgp].asn ), unpack( record.asn ) }
|
||||
combined_records[record.cache_bgp].asn = { table.unpack( combined_records[record.cache_bgp].asn ), table.unpack( record.asn ) }
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
local nmap = require "nmap"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Attempts to find the owner of an open TCP port by querying an auth
|
||||
daemon which must also be open on the target system. The auth service,
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
local comm = require "comm"
|
||||
local shortport = require "shortport"
|
||||
|
||||
description = [[
|
||||
Checks for an identd (auth) server which is spoofing its replies.
|
||||
|
||||
@@ -19,8 +22,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"malware", "safe"}
|
||||
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.port_or_service(113, "auth")
|
||||
|
||||
|
||||
@@ -1,3 +1,13 @@
|
||||
local bin = require "bin"
|
||||
local bit = require "bit"
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Performs brute force password auditing against the BackOrifice service. The
|
||||
<code>backorifice-brute.ports</code> script argument is mandatory (it specifies ports to run
|
||||
@@ -36,13 +46,6 @@ author = "Gorjan Petrovski"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require("nmap")
|
||||
require("bin")
|
||||
require("bit")
|
||||
require("shortport")
|
||||
require("brute")
|
||||
require("stdnse")
|
||||
require("creds")
|
||||
|
||||
-- This portrule succeeds only when the open|filtered port is in the port range
|
||||
-- which is specified by the ports script argument
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local bin = require "bin"
|
||||
local bit = require "bit"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Connects to a BackOrifice service and gathers information about
|
||||
the host and the BackOrifice service itself.
|
||||
@@ -67,11 +75,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "discovery", "safe"}
|
||||
dependencies = {"backorifice-brute"}
|
||||
|
||||
require("stdnse")
|
||||
require("nmap")
|
||||
require("bin")
|
||||
require("bit")
|
||||
require("shortport")
|
||||
|
||||
portrule = shortport.port_or_service (31337, "BackOrifice", "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds.
|
||||
|
||||
@@ -17,9 +22,6 @@ categories = {"discovery", "safe"}
|
||||
|
||||
|
||||
|
||||
local nmap = require "nmap"
|
||||
local comm = require "comm"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
|
||||
---
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local os = require "os"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local target = require "target"
|
||||
|
||||
local bitcoin = stdnse.silent_require "bitcoin"
|
||||
|
||||
description = [[
|
||||
Queries a Bitcoin server for a list of known Bitcoin nodes
|
||||
]]
|
||||
@@ -21,11 +29,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'tab'
|
||||
require 'target'
|
||||
require 'stdnse'
|
||||
stdnse.silent_require('bitcoin')
|
||||
|
||||
--
|
||||
-- Version 0.1
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bitcoin = require "bitcoin"
|
||||
local os = require "os"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Extracts version and node information from a Bitcoin server
|
||||
]]
|
||||
@@ -27,8 +33,6 @@ categories = {"discovery", "safe"}
|
||||
-- Created 11/09/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
--
|
||||
|
||||
require 'shortport'
|
||||
require 'bitcoin'
|
||||
|
||||
portrule = shortport.port_or_service(8333, "bitcoin", "tcp" )
|
||||
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local creds = require "creds"
|
||||
local http = require "http"
|
||||
local json = require "json"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Obtains information from a Bitcoin server by calling <code>getinfo</code> on its JSON-RPC interface.
|
||||
]]
|
||||
@@ -27,10 +36,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "discovery", "safe"}
|
||||
dependencies = {"http-brute"}
|
||||
|
||||
require 'http'
|
||||
require 'shortport'
|
||||
require 'json'
|
||||
require 'creds'
|
||||
|
||||
portrule = shortport.portnumber(8332)
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
|
||||
local bittorrent = stdnse.silent_require "bittorrent"
|
||||
|
||||
description = [[
|
||||
Discovers bittorrent peers sharing a file based on a user-supplied
|
||||
torrent file or magnet link. Peers implement the Bittorrent protocol
|
||||
@@ -39,9 +46,6 @@ author = "Gorjan Petrovski"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery","safe"}
|
||||
|
||||
require "target"
|
||||
require 'stdnse'
|
||||
stdnse.silent_require('bittorrent')
|
||||
|
||||
prerule = function()
|
||||
if not stdnse.get_script_args(SCRIPT_NAME..".torrent") and
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local bin = require "bin"
|
||||
local bit = require "bit"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local packet = require "packet"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers servers supporting the ATA over Ethernet protocol. ATA over Ethernet
|
||||
is an ethernet protocol developed by the Brantley Coile Company and allows for
|
||||
@@ -22,8 +31,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'packet'
|
||||
require 'bit'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -170,4 +177,4 @@ action = function()
|
||||
if ( #result > 0 ) then
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local dnssd = require "dnssd"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description=[[
|
||||
Attempts to discover hosts in the local network using the DNS Service
|
||||
Discovery protocol and sends a NULL UDP packet to each host to test
|
||||
@@ -36,8 +41,6 @@ author = "Djalal Harouni"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "dos", "intrusive", "vuln"}
|
||||
|
||||
require 'stdnse'
|
||||
require 'dnssd'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
description = [[
|
||||
Attempts to discover DB2 servers on the network by sending a broadcast request to port 523/udp.
|
||||
]]
|
||||
@@ -19,9 +25,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "target"
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -80,4 +83,4 @@ action = function()
|
||||
socket:close()
|
||||
|
||||
return stdnse.format_output( true, result )
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
local bin = require "bin"
|
||||
local coroutine = require "coroutine"
|
||||
local dhcp = require "dhcp"
|
||||
local ipOps = require "ipOps"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local packet = require "packet"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Sends a DHCP request to the broadcast address (255.255.255.255) and reports
|
||||
the results. The script uses a static MAC address (DE:AD:CO:DE:CA:FE) while
|
||||
@@ -38,10 +49,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
|
||||
require 'dhcp'
|
||||
require 'ipOps'
|
||||
require 'packet'
|
||||
require 'nmap'
|
||||
|
||||
prerule = function()
|
||||
if not nmap.is_privileged() then
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local coroutine = require "coroutine"
|
||||
local dhcp6 = require "dhcp6"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Sends a DHCPv6 request (Solicit) to the DHCPv6 multicast address,
|
||||
parses the response, then extracts and prints the address along with
|
||||
@@ -29,7 +35,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'dhcp6'
|
||||
|
||||
prerule = function()
|
||||
if not nmap.is_privileged() then
|
||||
@@ -108,4 +113,4 @@ action = function(host, port)
|
||||
until next(threads) == nil
|
||||
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
local dnssd = require "dnssd"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description=[[
|
||||
Attempts to discover hosts' services using the DNS Service Discovery protocol. It sends a multicast DNS-SD query and collects all the responses.
|
||||
|
||||
@@ -40,8 +43,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'dnssd'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local json = require "json"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local target = require "target"
|
||||
|
||||
description = [[
|
||||
Listens for the LAN sync information broadcasts that the Dropbox.com client broadcasts every 20 seconds, then prints all the discovered client IP addresses, port numbers, version numbers, display names, and more.
|
||||
|
||||
@@ -29,11 +35,6 @@ author = "Ron Bowes, Mak Kolybabi, Andrew Orr, Russ Tait Milne"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require("json")
|
||||
require("shortport")
|
||||
require("stdnse")
|
||||
require("tab")
|
||||
require("target")
|
||||
|
||||
local DROPBOX_BROADCAST_PERIOD = 20
|
||||
local DROPBOX_PORT = 17500
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local _G = require "_G"
|
||||
local bin = require "bin"
|
||||
local coroutine = require "coroutine"
|
||||
local nmap = require "nmap"
|
||||
local packet = require "packet"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Sniffs the network for incoming broadcast communication and
|
||||
attempts to decode the received packets. It supports protocols like CDP, HSRP,
|
||||
@@ -75,9 +83,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
|
||||
require('packet')
|
||||
require('tab')
|
||||
require('nmap')
|
||||
|
||||
|
||||
prerule = function()
|
||||
@@ -103,16 +108,16 @@ loadDecoders = function(fname)
|
||||
return false, ("ERROR: Failed to load decoder definition (%s)"):format(fname)
|
||||
end
|
||||
|
||||
local file = loadfile(abs_fname)
|
||||
local env = setmetatable({Decoders = {}}, {__index = _G});
|
||||
local file = loadfile(abs_fname, "t", env)
|
||||
if(not(file)) then
|
||||
stdnse.print_debug("%s: Couldn't load decoder file: %s", SCRIPT_NAME, fname)
|
||||
return false, "ERROR: Couldn't load decoder file: " .. fname
|
||||
end
|
||||
|
||||
setfenv(file, setmetatable({Decoders = {}; }, {__index = _G}))
|
||||
file()
|
||||
|
||||
local d = getfenv(file)["Decoders"]
|
||||
local d = env.Decoders
|
||||
|
||||
if ( d ) then return true, d end
|
||||
return false, "ERROR: Failed to load decoders"
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local mssql = require "mssql"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
-- -*- mode: lua -*-
|
||||
-- vim: set filetype=lua :
|
||||
|
||||
@@ -47,9 +53,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'mssql'
|
||||
require 'target'
|
||||
require 'stdnse'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bit = require "bit"
|
||||
local netbios = require "netbios"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
|
||||
description = [[
|
||||
Attempts to discover master browsers and the domains they manage.
|
||||
]]
|
||||
@@ -19,9 +25,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'netbios'
|
||||
require 'tab'
|
||||
require 'bit'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -62,4 +65,4 @@ action = function()
|
||||
end
|
||||
end
|
||||
return "\n" .. tab.dump(outtab)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local nmap = require "nmap"
|
||||
local rpc = require "rpc"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers the EMC Networker backup software server on a LAN by
|
||||
using network broadcasts.
|
||||
@@ -17,7 +22,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'rpc'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -88,4 +92,4 @@ action = function()
|
||||
if ( "table" == type(results) and 0 < #results ) then
|
||||
return stdnse.format_output(true, results)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bin = require "bin"
|
||||
local ipOps = require "ipOps"
|
||||
local srvloc = require "srvloc"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to use the Service Location Protocol to discover Novell NetWare Core Protocol (NCP) servers.
|
||||
]]
|
||||
@@ -21,8 +27,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'srvloc'
|
||||
require 'ipOps'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local nmap = require "nmap"
|
||||
local os = require "os"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Sends a special broadcast probe to discover PC-Anywhere hosts running on a LAN.
|
||||
]]
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local coroutine = require "coroutine"
|
||||
local nmap = require "nmap"
|
||||
local os = require "os"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers PC-DUO remote control hosts and gateways running on a LAN by sending a special UDP probe.
|
||||
]]
|
||||
@@ -119,4 +126,4 @@ action = function()
|
||||
if ( #responses > 0 ) then
|
||||
return stdnse.format_output(true, responses)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,15 @@
|
||||
local bin = require "bin"
|
||||
local coroutine = require "coroutine"
|
||||
local nmap = require "nmap"
|
||||
local packet = require "packet"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
local openssl = stdnse.silent_require "openssl"
|
||||
|
||||
description = [[
|
||||
Sends broadcast pings on a selected interface using raw ethernet packets and
|
||||
outputs the responding hosts' IP and MAC addresses or (if requested) adds them as targets. Root privileges on UNIX are required to run this script since it uses raw sockets. Most operating systems don't respond to broadcast-ping probes,
|
||||
@@ -46,13 +58,6 @@ author = "Gorjan Petrovski"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery","safe","broadcast"}
|
||||
|
||||
require "nmap"
|
||||
require "stdnse"
|
||||
require "packet"
|
||||
require "bin"
|
||||
require "tab"
|
||||
require "target"
|
||||
stdnse.silent_require("openssl")
|
||||
|
||||
prerule = function()
|
||||
if not nmap.is_privileged() then
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local pppoe = require "pppoe"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers PPPoE servers using the PPPoE Discovery protocol (PPPoED).
|
||||
PPPoE is an ethernet based protocol so the script has to know what ethernet
|
||||
@@ -27,8 +33,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'pppoe'
|
||||
require 'nmap'
|
||||
|
||||
prerule = function()
|
||||
if not nmap.is_privileged() then
|
||||
@@ -125,4 +129,4 @@ action = function()
|
||||
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description=[[
|
||||
Discovers hosts and routing information from devices running RIPv2 on the
|
||||
LAN. It does so by sending a RIPv2 Request command and collects the responses
|
||||
@@ -36,9 +43,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'bin'
|
||||
require 'ipOps'
|
||||
require 'tab'
|
||||
|
||||
prerule = function() return not( nmap.address_family() == "inet6") end
|
||||
|
||||
@@ -174,4 +178,4 @@ action = function()
|
||||
result.name = "Discovered RIPv2 devices"
|
||||
end
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers hosts and routing information from devices running RIPng on the
|
||||
LAN by sending a RIPng Request command and collecting the responses
|
||||
@@ -23,8 +30,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'ipOps'
|
||||
require 'tab'
|
||||
|
||||
prerule = function() return ( nmap.address_family() == "inet6" ) end
|
||||
|
||||
@@ -208,4 +213,4 @@ action = function()
|
||||
table.insert(result, { name = ip, parse_response(resp) } )
|
||||
end
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local bit = require "bit"
|
||||
local nmap = require "nmap"
|
||||
local os = require "os"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers Sybase Anywhere servers on the LAN by sending broadcast discovery messages.
|
||||
]]
|
||||
@@ -178,4 +185,4 @@ action = function()
|
||||
end
|
||||
table.sort(result)
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description=[[
|
||||
Discovers Telldus Technologies TellStickNet devices on the LAN. The Telldus
|
||||
TellStick is used to wirelessly control electric devices such as lights,
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
local stdnse = require "stdnse"
|
||||
local upnp = require "upnp"
|
||||
|
||||
description = [[
|
||||
Attempts to extract system information from the UPnP service by sending a multicast query, then collecting, parsing, and displaying all responses.
|
||||
]]
|
||||
@@ -30,8 +33,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require("shortport")
|
||||
require("upnp")
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local srvloc = require "srvloc"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Discovers Versant object databases using the srvloc protocol.
|
||||
]]
|
||||
@@ -17,7 +21,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'srvloc'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -32,4 +35,4 @@ action = function()
|
||||
table.insert(output, v:match("^service:odbms.versant:vod://(.*)$"))
|
||||
end
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Wakes a remote system up from sleep by sending a Wake-On-Lan packet.
|
||||
]]
|
||||
@@ -64,4 +68,4 @@ action = function()
|
||||
end
|
||||
return stdnse.format_output(true, ("Sent WOL packet to: %s"):format(MAC))
|
||||
end
|
||||
|
||||
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local dhcp = require "dhcp"
|
||||
local dns = require "dns"
|
||||
local http = require "http"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local url = require "url"
|
||||
|
||||
description = [[
|
||||
Retrieves a list of proxy servers on the LAN using the Web Proxy
|
||||
Autodiscovery Protocol (WPAD). It implements both the DHCP and DNS
|
||||
@@ -26,10 +35,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'dns'
|
||||
require 'dhcp'
|
||||
require 'http'
|
||||
require 'url'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -224,4 +229,4 @@ action = function()
|
||||
local output = ( arg_getwpad and response or parseWPAD(response) )
|
||||
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local coroutine = require "coroutine"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local wsdd = require "wsdd"
|
||||
|
||||
description = [[
|
||||
Uses a multicast query to discover devices supporting the Web Services
|
||||
Dynamic Discovery (WS-Discovery) protocol. It also attempts to locate
|
||||
@@ -39,8 +45,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'wsdd'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -57,15 +61,8 @@ discoverThread = function( funcname, results )
|
||||
helper:setMulticast(true)
|
||||
helper:setTimeout(timeout)
|
||||
|
||||
local func = loadstring( "return helper:" .. funcname .. "()" )
|
||||
setfenv(func, setmetatable({ helper=helper; }, {__index = _G}))
|
||||
|
||||
if ( func ) then
|
||||
local status, result = func()
|
||||
if ( status ) then table.insert(results, result) end
|
||||
else
|
||||
stdnse.print_debug("ERROR: Failed to call function: %s", funcname)
|
||||
end
|
||||
local status, result = helper[funcname](helper)
|
||||
if ( status ) then table.insert(results, result) end
|
||||
condvar("broadcast")
|
||||
end
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local os = require "os"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local xdmcp = require "xdmcp"
|
||||
|
||||
description = [[
|
||||
Discovers servers running the X Display Manager Control Protocol (XDMCP) by
|
||||
sending a XDMCP broadcast request to the LAN. Display managers allowing access
|
||||
@@ -19,7 +24,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"broadcast", "safe"}
|
||||
|
||||
require 'xdmcp'
|
||||
|
||||
prerule = function() return true end
|
||||
|
||||
@@ -66,4 +70,4 @@ action = function()
|
||||
end
|
||||
end
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Detects the CCcam service (software for sharing subscription TV among
|
||||
multiple receivers).
|
||||
@@ -14,8 +19,6 @@ categories = {"version"}
|
||||
|
||||
author = "David Fifield"
|
||||
|
||||
require("bin")
|
||||
require("shortport")
|
||||
|
||||
-- A chi-square test for the null hypothesis that the members of data are drawn
|
||||
-- from a uniform distribution over num_cats categories.
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local citrixxml = require "citrixxml"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local unpwdb = require "unpwdb"
|
||||
|
||||
description = [[
|
||||
Attempts to guess valid credentials for the Citrix PN Web Agent XML
|
||||
Service. The XML service authenticates against the local Windows server
|
||||
@@ -30,9 +37,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "auth"}
|
||||
|
||||
require 'unpwdb'
|
||||
require 'shortport'
|
||||
require 'citrixxml'
|
||||
|
||||
portrule = shortport.portnumber({8080,80,443}, "tcp")
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local citrixxml = require "citrixxml"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Extracts a list of applications, ACLs, and settings from the Citrix XML
|
||||
service.
|
||||
@@ -60,9 +66,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require "comm"
|
||||
require 'shortport'
|
||||
require 'citrixxml'
|
||||
|
||||
portrule = shortport.portnumber({8080,80,443}, "tcp")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Extracts a list of published applications from the ICA Browser service.
|
||||
]]
|
||||
@@ -26,10 +33,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"discovery","safe"}
|
||||
|
||||
require "comm"
|
||||
require "shortport"
|
||||
require "stdnse"
|
||||
require "bin"
|
||||
|
||||
portrule = shortport.portnumber(1604, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local citrixxml = require "citrixxml"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Extracts the name of the server farm and member servers from Citrix XML
|
||||
service.
|
||||
@@ -23,9 +28,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require "comm"
|
||||
require 'shortport'
|
||||
require 'citrixxml'
|
||||
|
||||
portrule = shortport.portnumber({8080,80,443}, "tcp")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Extracts a list of Citrix servers from the ICA Browser service.
|
||||
]]
|
||||
@@ -23,8 +30,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.portnumber(1604, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local http = require "http"
|
||||
local json = require "json"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Gets database tables from a CouchDB database.
|
||||
|
||||
@@ -28,14 +35,11 @@ http://wiki.apache.org/couchdb/HTTP_database_API.
|
||||
author = "Martin Holst Swende"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
require "shortport"
|
||||
require "http"
|
||||
require "json"
|
||||
|
||||
portrule = shortport.port_or_service({5984})
|
||||
-- Some lazy shortcuts
|
||||
local function dbg(str,...)
|
||||
stdnse.print_debug("couchdb-get-tables:"..str, unpack(arg))
|
||||
stdnse.print_debug("couchdb-get-tables:"..str, table.unpack(arg))
|
||||
end
|
||||
|
||||
local DISCARD = {}
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local http = require "http"
|
||||
local json = require "json"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Gets database statistics from a CouchDB database.
|
||||
|
||||
@@ -40,13 +48,10 @@ http://wiki.apache.org/couchdb/HTTP_database_API.
|
||||
author = "Martin Holst Swende"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
require "shortport"
|
||||
require "http"
|
||||
require "json"
|
||||
portrule = shortport.port_or_service({5984})
|
||||
-- Some lazy shortcuts
|
||||
local function dbg(str,...)
|
||||
stdnse.print_debug("couchdb-stats:"..str, unpack(arg))
|
||||
stdnse.print_debug("couchdb-stats:"..str, table.unpack(arg))
|
||||
end
|
||||
|
||||
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
local creds = require "creds"
|
||||
|
||||
description = [[
|
||||
Lists all discovered credentials (e.g. from brute force and default password checking scripts) at end of scan.
|
||||
]]
|
||||
@@ -26,7 +28,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"auth", "default", "safe"}
|
||||
|
||||
require 'creds'
|
||||
|
||||
postrule = function()
|
||||
local all = creds.Credentials:new(creds.ALL_DATA)
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bin = require "bin"
|
||||
local ipp = require "ipp"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Lists printers managed by the CUPS printing service.
|
||||
]]
|
||||
@@ -34,9 +40,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe", "discovery"}
|
||||
|
||||
local http = require('http')
|
||||
local shortport = require('shortport')
|
||||
local ipp = require('ipp')
|
||||
|
||||
portrule = shortport.port_or_service(631, "ipp", "tcp", "open")
|
||||
|
||||
@@ -75,4 +78,4 @@ action = function(host, port)
|
||||
if ( 0 ~= #output ) then
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local ipp = require "ipp"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Lists currently queued print jobs of the remote CUPS service grouped by
|
||||
printer.
|
||||
@@ -27,9 +31,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe", "discovery"}
|
||||
|
||||
local http = require('http')
|
||||
local shortport = require('shortport')
|
||||
local ipp = require('ipp')
|
||||
|
||||
portrule = shortport.port_or_service(631, "ipp", "tcp", "open")
|
||||
|
||||
@@ -45,4 +46,4 @@ action = function(host, port)
|
||||
if ( output ) then
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local brute = require "brute"
|
||||
local coroutine = require "coroutine"
|
||||
local cvs = require "cvs"
|
||||
local io = require "io"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to guess the name of the CVS repositories hosted on the remote server.
|
||||
With knowledge of the correct repository name, usernames and passwords can be guessed.
|
||||
@@ -29,10 +38,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require 'cvs'
|
||||
require 'brute'
|
||||
require 'creds'
|
||||
require 'shortport'
|
||||
|
||||
portrule = shortport.port_or_service(2401, "cvspserver")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local cvs = require "cvs"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[
|
||||
Performs brute force password auditing against CVS pserver authentication.
|
||||
]]
|
||||
@@ -30,10 +37,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
dependencies = {"cvs-brute-repository"}
|
||||
|
||||
require 'cvs'
|
||||
require 'brute'
|
||||
require 'creds'
|
||||
require 'shortport'
|
||||
|
||||
portrule = shortport.port_or_service(2401, "cvspserver")
|
||||
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local bin = require "bin"
|
||||
local http = require "http"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Retrieves a list of music from a DAAP server. The list includes artist
|
||||
names and album and song titles.
|
||||
@@ -36,9 +44,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'http'
|
||||
|
||||
-- Version 0.2
|
||||
-- Created 01/14/2010 - v0.1 - created by Patrik Karlsson
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
local comm = require "comm"
|
||||
local shortport = require "shortport"
|
||||
|
||||
description = [[
|
||||
Retrieves the day and time from the Daytime service.
|
||||
]]
|
||||
@@ -14,8 +17,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.port_or_service(13, "daytime", {"tcp", "udp"})
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Connects to the IBM DB2 Administration Server (DAS) on TCP or UDP port 523 and
|
||||
exports the server profile. No authentication is required for this request.
|
||||
@@ -61,8 +67,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"safe", "discovery", "version"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
|
||||
--- Research Notes:
|
||||
--
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to discover DB2 servers on the network by querying open ibm-db2 UDP ports (normally port 523).
|
||||
]]
|
||||
@@ -23,8 +29,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe", "default"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.version_port_or_service(523, "ibm-db2", "udp",
|
||||
{"open", "open|filtered"})
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local dhcp = require "dhcp"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Sends a DHCPINFORM request to a host on UDP port 67 to obtain all the local configuration parameters
|
||||
without allocating a new address.
|
||||
@@ -59,11 +67,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'bin'
|
||||
require 'bit'
|
||||
require 'dhcp'
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
|
||||
-- We want to run against a specific host if UDP/67 is open
|
||||
function portrule(host, port)
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Connects to a dictionary server using the DICT protocol and runs the SHOW
|
||||
SERVER command and displays the result. The DICT protocol is defined in RFC
|
||||
@@ -29,7 +34,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
local shortport = require('shortport')
|
||||
|
||||
portrule = shortport.port_or_service(2628, "dict", "tcp")
|
||||
|
||||
@@ -71,4 +75,4 @@ action = function(host, port)
|
||||
srvinfo[#srvinfo] = ( srvinfo[#srvinfo] ~= "" and srvinfo[#srvinfo] or nil )
|
||||
|
||||
return stdnse.format_output(true, srvinfo)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local vulns = require "vulns"
|
||||
|
||||
description = [[
|
||||
Detects and exploits a remote code execution vulnerability in the distributed
|
||||
compiler daemon distcc. The vulnerability was disclosed in 2002, but is still
|
||||
@@ -39,8 +44,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"exploit", "intrusive", "vuln"}
|
||||
|
||||
local shortport = require('shortport')
|
||||
local vulns = require('vulns')
|
||||
|
||||
portrule = shortport.port_or_service(3632, "distcc")
|
||||
|
||||
@@ -102,4 +105,4 @@ earlier. The vulnerability is the consequence of weak service configuration.
|
||||
return report:make_output(distcc_vuln)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local dnsbl = require "dnsbl"
|
||||
local ipOps = require "ipOps"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Checks target IP addresses against multiple DNS anti-spam and open
|
||||
proxy blacklists and returns a list of services for which an IP has been flagged. Checks may be limited by service category (eg: SPAM,
|
||||
@@ -68,10 +73,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"external", "safe"}
|
||||
|
||||
require 'dns'
|
||||
require 'dnsbl'
|
||||
require 'tab'
|
||||
require 'ipOps'
|
||||
|
||||
-- The script can be run either as a host- or pre-rule
|
||||
hostrule = function() return true end
|
||||
|
||||
@@ -1,3 +1,13 @@
|
||||
local coroutine = require "coroutine"
|
||||
local dns = require "dns"
|
||||
local io = require "io"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
description = [[
|
||||
Attempts to enumerate DNS hostnames by brute force guessing of common subdomains.
|
||||
]]
|
||||
@@ -43,9 +53,6 @@ hostrule = function(host)
|
||||
end
|
||||
|
||||
|
||||
require 'dns'
|
||||
require 'stdnse'
|
||||
require 'target'
|
||||
|
||||
local HOST_LIST = {
|
||||
'www', 'mail', 'blog', 'ns0', 'ns1', 'mail2', 'mail3', 'admin', 'ads', 'ssh',
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local dns = require "dns"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Performs DNS cache snooping against a DNS server.
|
||||
|
||||
@@ -47,11 +54,6 @@ different list.
|
||||
-- | www.google.co.uk
|
||||
-- |_www.linkedin.com
|
||||
|
||||
require("shortport")
|
||||
require("dns")
|
||||
require("stdnse")
|
||||
require("nmap")
|
||||
require("math")
|
||||
|
||||
author = "Eugene V. Alexeev"
|
||||
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local dns = require "dns"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Checks DNS zone configuration against best practices, including RFC 1912.
|
||||
The configuration checks are divided into categories that each have a number
|
||||
@@ -48,9 +52,6 @@ categories = {"discovery", "safe", "external"}
|
||||
|
||||
local arg_domain = stdnse.get_script_args(SCRIPT_NAME .. '.domain')
|
||||
|
||||
local shortport = require('shortport')
|
||||
local dns = require('dns')
|
||||
local ipops = require('ipOps')
|
||||
|
||||
hostrule = function(host) return ( arg_domain ~= nil ) end
|
||||
|
||||
@@ -445,4 +446,4 @@ action = function(host, port)
|
||||
table.insert(output, group_output)
|
||||
end
|
||||
return stdnse.format_output(true, output)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local dns = require "dns"
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Performs a domain lookup using the edns-client-subnet option that adds
|
||||
support for adding subnet information to the query describing where the
|
||||
@@ -44,9 +51,6 @@ author = "John Bond"
|
||||
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "dns"
|
||||
|
||||
local argNS = stdnse.get_script_args(SCRIPT_NAME .. '.nameserver')
|
||||
local argDomain = stdnse.get_script_args(SCRIPT_NAME .. '.domain')
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local bit = require "bit"
|
||||
local comm = require "comm"
|
||||
local dns = require "dns"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Launches a DNS fuzzing attack against DNS servers.
|
||||
|
||||
@@ -30,11 +39,6 @@ author = "Michael Pattrick"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"fuzzer", "intrusive"}
|
||||
|
||||
require "bit"
|
||||
require "dns"
|
||||
require "stdnse"
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.portnumber(53, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local coroutine = require "coroutine"
|
||||
local dns = require "dns"
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Performs IPv6 a quick reverse lookup of an IPv6 network using a technique
|
||||
that allows reducing the amount of queries by analyzing DNS server response
|
||||
@@ -13,7 +21,7 @@ http://7bits.nl/blog/2012/03/26/finding-v6-hosts-by-efficiently-mapping-ip6-arpa
|
||||
|
||||
---
|
||||
-- @usage
|
||||
-- nmap --script dns-ipv6-arpa-scan --script-args='prefix=2001:0DB8,mask=48'
|
||||
-- nmap --script dns-ip6-arpa-scan --script-args='prefix=2001:0DB8,mask=48'
|
||||
--
|
||||
-- @output
|
||||
-- Pre-scan script results:
|
||||
@@ -29,23 +37,17 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "discovery"}
|
||||
|
||||
require 'dns'
|
||||
require 'ipOps'
|
||||
require 'tab'
|
||||
|
||||
local arg_prefix = stdnse.get_script_args(SCRIPT_NAME .. ".prefix")
|
||||
local arg_mask = stdnse.get_script_args(SCRIPT_NAME .. ".mask")
|
||||
|
||||
prerule = function() return (arg_prefix ~= nil and arg_mask ~= nil) end
|
||||
|
||||
local pending = {}
|
||||
local result = {}
|
||||
|
||||
local function query_prefix(query)
|
||||
local function query_prefix(query, result)
|
||||
local condvar = nmap.condvar(result)
|
||||
local status, res = dns.query(query, { dtype='PTR' })
|
||||
if ( not(status) and res == "No Answers") then
|
||||
table.insert(pending, query)
|
||||
table.insert(result, query)
|
||||
elseif ( status ) then
|
||||
local ip = query:sub(1, -10):gsub('%.',''):reverse():gsub('(....)', '%1:'):sub(1, -2)
|
||||
ip = ipOps.bin_to_ip(ipOps.ip_to_bin(ip))
|
||||
@@ -67,11 +69,12 @@ action = function()
|
||||
|
||||
local i = 20
|
||||
|
||||
local result
|
||||
repeat
|
||||
pending = {}
|
||||
result = {}
|
||||
for _, f in ipairs(found) do
|
||||
for q in ("0123456789abcdef"):gmatch("(%w)") do
|
||||
local co = stdnse.new_thread(query_prefix, q .. "." .. f)
|
||||
local co = stdnse.new_thread(query_prefix, q .. "." .. f, result)
|
||||
threads[co] = true
|
||||
end
|
||||
end
|
||||
@@ -84,11 +87,11 @@ action = function()
|
||||
end
|
||||
until( next(threads) == nil )
|
||||
|
||||
if ( 0 == #pending ) then
|
||||
break
|
||||
if ( 0 == #result ) then
|
||||
return
|
||||
end
|
||||
|
||||
found = pending
|
||||
found = result
|
||||
i = i + 1
|
||||
until( 128 == i * 2 + arg_mask )
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local dns = require "dns"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Enumerates DNS names using the DNSSEC NSEC-walking technique.
|
||||
|
||||
@@ -41,9 +47,6 @@ license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licen
|
||||
|
||||
categories = {"discovery", "intrusive"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "dns"
|
||||
|
||||
portrule = shortport.port_or_service(53, "domain", {"tcp", "udp"})
|
||||
|
||||
@@ -163,7 +166,7 @@ local function increment_component(name)
|
||||
bytes[i] = DNS_CHARS[index]
|
||||
end
|
||||
|
||||
return string.char(unpack(bytes))
|
||||
return string.char(table.unpack(bytes))
|
||||
end
|
||||
|
||||
-- Return the lexicographically next domain name that does not add a new
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bin = require "bin"
|
||||
local dns = require "dns"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Retrieves information from a DNS nameserver by requesting
|
||||
its nameserver ID (nsid) and asking for its id.server and
|
||||
@@ -28,9 +34,6 @@ license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licen
|
||||
|
||||
categories = {"discovery", "default"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "dns"
|
||||
|
||||
portrule = shortport.port_or_service(53, "domain", {"tcp", "udp"})
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bit = require "bit"
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Checks a DNS server for the predictable-port recursion vulnerability.
|
||||
Predictable source ports can make a DNS server vulnerable to cache poisoning
|
||||
@@ -32,9 +38,6 @@ porttest.dns-oarc.net: Duane Wessels <wessels@dns-oarc.net>
|
||||
|
||||
categories = {"external", "intrusive"}
|
||||
|
||||
require "bit"
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.portnumber(53, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bit = require "bit"
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Checks a DNS server for the predictable-TXID DNS recursion
|
||||
vulnerability. Predictable TXID values can make a DNS server vulnerable to
|
||||
@@ -32,9 +38,6 @@ txidtest.dns-oarc.net: Duane Wessels <wessels@dns-oarc.net>
|
||||
|
||||
categories = {"external", "intrusive"}
|
||||
|
||||
require "bit"
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.portnumber(53, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local bit = require "bit"
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Checks if a DNS server allows queries for third-party names. It is
|
||||
expected that recursion will be enabled on your own internal
|
||||
@@ -16,9 +22,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"default", "safe"}
|
||||
|
||||
require "bit"
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.portnumber(53, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local dnssd = require "dnssd"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description=[[
|
||||
Attempts to discover target hosts' services using the DNS Service Discovery protocol.
|
||||
|
||||
@@ -46,8 +51,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'dnssd'
|
||||
|
||||
portrule = shortport.portnumber(5353, "udp")
|
||||
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local coroutine = require "coroutine"
|
||||
local dns = require "dns"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
description = [[
|
||||
Enumerates various common service (SRV) records for a given domain name.
|
||||
The service records contain the hostname, port and priority of servers for a given service.
|
||||
@@ -54,9 +62,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'dns'
|
||||
require 'tab'
|
||||
require 'target'
|
||||
|
||||
local arg_domain = stdnse.get_script_args(SCRIPT_NAME .. ".domain")
|
||||
local arg_filter = stdnse.get_script_args(SCRIPT_NAME .. ".filter")
|
||||
@@ -171,4 +176,4 @@ action = function(host)
|
||||
table.sort(result, function(a,b) return a.name < b.name end)
|
||||
|
||||
return stdnse.format_output(true, result)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local dns = require "dns"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to perform a dynamic DNS update without authentication.
|
||||
]]
|
||||
@@ -39,8 +45,6 @@ categories = {"discovery", "safe"}
|
||||
-- Created 01/09/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
-- Revised 01/10/2011 - v0.2 - added test function <patrik@cqure.net>
|
||||
|
||||
require 'shortport'
|
||||
require 'dns'
|
||||
|
||||
portrule = shortport.port_or_service( 53, "dns", "udp", {"open", "open|filtered"} )
|
||||
|
||||
@@ -97,4 +101,4 @@ action = function(host, port)
|
||||
return "\n ERROR: " .. err
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local dns = require "dns"
|
||||
local ipOps = require "ipOps"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Checks if the target IP range is part of a Zeus botnet by querying ZTDNS @ abuse.ch.
|
||||
Please review the following information before you start to scan:
|
||||
@@ -18,10 +24,6 @@ author = "Mikael Keri"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe", "discovery", "external", "malware"}
|
||||
|
||||
require "dns"
|
||||
require "ipOps"
|
||||
require "stdnse"
|
||||
require "tab"
|
||||
|
||||
|
||||
hostrule = function(host) return not(ipOps.isPrivate(host.ip)) end
|
||||
@@ -50,7 +52,7 @@ action = function(host)
|
||||
"Files Online", "Date added")
|
||||
for _, record in ipairs(result) do
|
||||
local name, ip, sbl, asn, country, status, level, files_online,
|
||||
dateadded = unpack(stdnse.strsplit("| ", record))
|
||||
dateadded = table.unpack(stdnse.strsplit("| ", record))
|
||||
level = levels[tonumber(level)] or "Unknown"
|
||||
tab.addrow(output, name, ip, sbl, asn, country, status, level, files_online, dateadded)
|
||||
end
|
||||
|
||||
@@ -1,3 +1,16 @@
|
||||
local bit = require "bit"
|
||||
local dns = require "dns"
|
||||
local ipOps = require "ipOps"
|
||||
local listop = require "listop"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local strbuf = require "strbuf"
|
||||
local string = require "string"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
local target = require "target"
|
||||
|
||||
description = [[
|
||||
Requests a zone transfer (AXFR) from a DNS server.
|
||||
|
||||
@@ -68,15 +81,6 @@ Useful resources
|
||||
-- nmap --script dns-zone-transfer.nse \
|
||||
-- --script-args dns-zone-transfer.domain=<domain>
|
||||
|
||||
require('shortport')
|
||||
require('strbuf')
|
||||
require('stdnse')
|
||||
require('listop')
|
||||
require('bit')
|
||||
require('tab')
|
||||
require('dns')
|
||||
require('target')
|
||||
require('ipOps')
|
||||
|
||||
author = "Eddie Bell"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Performs brute force password auditing against the Lotus Domino Console.
|
||||
]]
|
||||
@@ -27,9 +34,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require 'shortport'
|
||||
require 'brute'
|
||||
require 'creds'
|
||||
|
||||
portrule = shortport.port_or_service(2050, "", "tcp", "open")
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Runs a console command on the Lotus Domino Console using the given authentication credentials (see also: domcon-brute)
|
||||
]]
|
||||
@@ -54,7 +59,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "auth"}
|
||||
|
||||
require 'shortport'
|
||||
|
||||
portrule = shortport.port_or_service(2050, "dominoconsole", "tcp", "open")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local io = require "io"
|
||||
local nrpc = require "nrpc"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local table = require "table"
|
||||
local unpwdb = require "unpwdb"
|
||||
|
||||
description = [[
|
||||
Attempts to discover valid IBM Lotus Domino users and download their ID files by exploiting the CVE-2006-5835 vulnerability.
|
||||
]]
|
||||
@@ -37,9 +44,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "auth"}
|
||||
|
||||
require 'shortport'
|
||||
require 'nrpc'
|
||||
require 'unpwdb'
|
||||
|
||||
portrule = shortport.port_or_service(1352, "lotusnotes", "tcp", "open")
|
||||
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
local base64 = require "base64"
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
|
||||
description = [[
|
||||
Performs brute force password auditing against an iPhoto Library.
|
||||
]]
|
||||
@@ -24,10 +30,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require("base64")
|
||||
require("shortport")
|
||||
require("brute")
|
||||
require("creds")
|
||||
|
||||
portrule = shortport.port_or_service(8770, "apple-iphoto")
|
||||
|
||||
|
||||
@@ -1,3 +1,12 @@
|
||||
local coroutine = require "coroutine"
|
||||
local drda = require "drda"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
local unpwdb = require "unpwdb"
|
||||
|
||||
description = [[
|
||||
Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby
|
||||
]]
|
||||
@@ -20,10 +29,6 @@ author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories={"intrusive", "brute"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "drda"
|
||||
require "unpwdb"
|
||||
|
||||
-- Version 0.5
|
||||
-- Created 05/08/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local drda = require "drda"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to extract information from database servers supporting the DRDA
|
||||
protocol. The script sends a DRDA EXCSAT (exchange server attributes)
|
||||
@@ -19,9 +26,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"safe", "discovery", "version"}
|
||||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "drda"
|
||||
|
||||
-- Version 0.1
|
||||
-- Created 05/08/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local ipOps = require "ipOps"
|
||||
local nmap = require "nmap"
|
||||
local ssh1 = require "ssh1"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Attempts to discover multihomed systems by analysing and
|
||||
comparing information collected by other scripts. The information analyzed
|
||||
@@ -49,7 +56,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe"}
|
||||
dependencies = {"ssl-cert", "ssh-hostkey", "nbstat"}
|
||||
|
||||
require 'ipOps'
|
||||
|
||||
hostrule = function() return true end
|
||||
postrule = function() return true end
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local eap = require "eap"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Enumerates the authentication methods offered by an EAP authenticator for a
|
||||
given identity or for the anonymous identity if no argument is passed.
|
||||
@@ -26,11 +33,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = { "broadcast", "safe" }
|
||||
|
||||
require 'nmap'
|
||||
require 'packet'
|
||||
require 'bin'
|
||||
require 'stdnse'
|
||||
require 'eap'
|
||||
|
||||
prerule = function()
|
||||
return nmap.is_privileged()
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local bin = require "bin"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Connects to Erlang Port Mapper Daemon (epmd) and retrieves a list of nodes with their respective port numbers.
|
||||
]]
|
||||
@@ -17,8 +24,6 @@ Connects to Erlang Port Mapper Daemon (epmd) and retrieves a list of nodes with
|
||||
author = "Toni Ruottu"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "discovery", "safe"}
|
||||
require "shortport"
|
||||
require "bin"
|
||||
|
||||
portrule = shortport.port_or_service (4369, "epmd")
|
||||
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
local comm = require "comm"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
|
||||
description = [[
|
||||
Attempts to retrieve a list of usernames using the finger service.
|
||||
]]
|
||||
@@ -22,8 +26,6 @@ categories = {"default", "discovery", "safe"}
|
||||
-- | Gutek Ange Gutek *pts/0 - Thu 00:41
|
||||
-- |_Gutek Ange Gutek *pts/4 3 Thu 01:06
|
||||
|
||||
require "comm"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.port_or_service(79, "finger")
|
||||
|
||||
|
||||
@@ -1,3 +1,11 @@
|
||||
local bin = require "bin"
|
||||
local math = require "math"
|
||||
local nmap = require "nmap"
|
||||
local packet = require "packet"
|
||||
local stdnse = require "stdnse"
|
||||
local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Tries to discover firewall rules using an IP TTL expiration technique known
|
||||
as firewalking.
|
||||
@@ -73,10 +81,6 @@ categories = {"safe", "discovery"}
|
||||
-- o remove traceroute dependency
|
||||
|
||||
|
||||
require('bin')
|
||||
require('stdnse')
|
||||
require('packet')
|
||||
require('tab')
|
||||
|
||||
|
||||
-----= scan parameters defaults =-----
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local ftp = require "ftp"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Checks if an FTP server allows anonymous logins.
|
||||
|
||||
@@ -27,8 +34,6 @@ author = "Eddie Bell, Rob Nicholls, Ange Gutek, David Fifield"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"default", "auth", "safe"}
|
||||
|
||||
require "ftp"
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.port_or_service(21, "ftp")
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
local coroutine = require "coroutine"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local string = require "string"
|
||||
|
||||
description=[[
|
||||
Checks to see if an FTP server allows port scanning using the FTP bounce method.
|
||||
]]
|
||||
@@ -25,7 +30,6 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"default", "safe"}
|
||||
|
||||
require "shortport"
|
||||
|
||||
portrule = shortport.service("ftp")
|
||||
|
||||
|
||||
@@ -1,3 +1,10 @@
|
||||
local brute = require "brute"
|
||||
local creds = require "creds"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
|
||||
description = [[
|
||||
Performs brute force password auditing against FTP servers.
|
||||
|
||||
@@ -28,10 +35,6 @@ author = "Aleksandar Nikolic"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"intrusive", "brute"}
|
||||
|
||||
require 'shortport'
|
||||
require 'brute'
|
||||
require 'creds'
|
||||
|
||||
portrule = shortport.port_or_service(21, "ftp")
|
||||
|
||||
local arg_timeout = stdnse.get_script_args(SCRIPT_NAME .. ".timeout") or 5
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user