PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix some NSEdoc using the wrong script names

Browse Source
This commit is contained in:
dmiller
2017-03-24 22:05:51 +00:00
parent 312fbbfcf1
commit 1d3b5142be
33 changed files with 74 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
nselib/amqp.lua
View File

@@ -13,7 +13,8 @@
-- o AMQP
-- - This class contains the core functions needed to communicate with AMQP
--
-- @args amqp.version Can be used to specify the client version to use (currently, 0-8, 0-9 or 0-9-1)
--
-- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html
-- @author Sebastian Dragomir <velorien@gmail.com>

3
nselib/proxy.lua
View File

@@ -1,6 +1,9 @@
---
-- Functions for proxy testing.
--
-- @args proxy.url Url that will be requested to the proxy
-- @args proxy.pattern Pattern that will be searched inside the request results
--
-- @author Joao Correa <joao@livewire.com.br>
-- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html

4
scripts/allseeingeye-info.nse
View File

@@ -16,7 +16,7 @@ with the payload "s", it replies with various game server status info.
When run as a version detection script (<code>-sV</code>), the script
will report on the game name, version, actual port, and whether it has a
password. When run explicitly (<code>--script ase-info</code>), the
password. When run explicitly (<code>--script allseeingeye-info</code>), the
script will additionally report on the server name, game type, map name,
current number of players, maximum number of players, player
information, and various other information.
@@ -37,7 +37,7 @@ http://sourceforge.net/projects/gameq/
-- @output
-- PORT STATE SERVICE REASON VERSION
-- 27138/udp open allseeingeye udp-response All-Seeing Eye (game: chrome 1.2.0.0ww; port: 27015; no password)
-- | ase-info:
-- | allseeingeye-info:
-- | game: chrome
-- | port: 27015
-- | server name: ChromeNet Server

2
scripts/amqp-info.nse
View File

@@ -14,8 +14,6 @@ See http://www.rabbitmq.com/extensions.html for details on the
-- @usage
-- nmap --script amqp-info -p5672 <target>
---
-- @args amqp.version Can be used to specify the client version to use (currently, 0-8, 0-9 or 0-9-1)
--
-- @output
-- 5672/tcp open amqp
-- | amqp-info:

6
scripts/bittorrent-discovery.nse
View File

@@ -23,11 +23,11 @@ peers as targets.
--
-- @args bittorrent-discovery.torrent a string containing the filename of the torrent file
-- @args bittorrent-discovery.magnet a string containing the magnet link of the torrent
-- @args bittorrent-discover.timeout desired (not actual) timeout for the DHT discovery (default = 30s)
-- @args bittorrent-discover.include-nodes boolean selecting whether to show only nodes
-- @args bittorrent-discovery.timeout desired (not actual) timeout for the DHT discovery (default = 30s)
-- @args bittorrent-discovery.include-nodes boolean selecting whether to show only nodes
--
-- @output
-- | bittorrent-peers:
-- | bittorrent-discovery:
-- | Peers:
-- | 97.88.178.168
-- | 89.100.184.36

10
scripts/cics-user-brute.nse
View File

@@ -12,19 +12,19 @@ CICS User ID brute forcing script for the CESL login screen.
]]
---
-- @args cics-user-enum.commands Commands in a semi-colon seperated list needed
-- @args cics-user-brute.commands Commands in a semi-colon seperated list needed
-- to access CICS. Defaults to <code>CICS</code>.
--
-- @usage
-- nmap --script=cics-user-enum -p 23 <targets>
-- nmap --script=cics-user-brute -p 23 <targets>
--
-- nmap --script=cics-user-enum --script-args userdb=users.txt,
-- cics-user-enum.commands="exit;logon applid(cics42)" -p 23 <targets>
-- nmap --script=cics-user-brute --script-args userdb=users.txt,
-- cics-user-brute.commands="exit;logon applid(cics42)" -p 23 <targets>
--
-- @output
-- PORT STATE SERVICE
-- 23/tcp open tn3270
-- | cics-user-enum:
-- | cics-user-brute:
-- | Accounts:
-- | PLAGUE: Valid - CICS User ID
-- |_ Statistics: Performed 31 guesses in 114 seconds, average tps: 0

2
scripts/distcc-cve2004-2687.nse
View File

@@ -16,7 +16,7 @@ present in modern implementation due to poor configuration of the service.
-- @output
-- PORT STATE SERVICE
-- 3632/tcp open distccd
-- | distcc-test:
-- | distcc-exec:
-- | VULNERABLE:
-- | distcc Daemon Command Execution
-- | State: VULNERABLE (Exploitable)

16
scripts/dns-client-subnet-scan.nse
View File

@@ -22,13 +22,13 @@ requests using a given subnet.
-- nmap -sU -p 53 --script dns-client-subnet-scan --script-args \
-- 'dns-client-subnet-scan.domain=www.example.com, \
-- dns-client-subnet-scan.address=192.168.0.1 \
-- [,dns-client-subnet.nameserver=8.8.8.8] \
-- [,dns-client-subnet.mask=24]' <target>
-- [,dns-client-subnet-scan.nameserver=8.8.8.8] \
-- [,dns-client-subnet-scan.mask=24]' <target>
-- nmap --script dns-client-subnet-scan --script-args \
-- 'dns-client-subnet-scan.domain=www.example.com, \
-- dns-client-subnet-scan.address=192.168.0.1 \
-- dns-client-subnet.nameserver=8.8.8.8, \
-- [,dns-client-subnet.mask=24]'
-- dns-client-subnet-scan.nameserver=8.8.8.8, \
-- [,dns-client-subnet-scan.mask=24]'
--
-- @output
-- 53/udp open domain udp-response
@@ -42,10 +42,10 @@ requests using a given subnet.
-- | .
-- |_ .
---
-- @args dns-client-subnet.domain The domain to lookup eg. www.example.org
-- @args dns-client-subnet.address The client subnet address to use
-- @args dns-client-subnet.mask [optional] The number of bits to use as subnet mask (default: 24)
-- @args dns-client-subnet.nameserver [optional] nameserver to use. (default = host.ip)
-- @args dns-client-subnet-scan.domain The domain to lookup eg. www.example.org
-- @args dns-client-subnet-scan.address The client subnet address to use
-- @args dns-client-subnet-scan.mask [optional] The number of bits to use as subnet mask (default: 24)
-- @args dns-client-subnet-scan.nameserver [optional] nameserver to use. (default = host.ip)
--
author = "John R. Bond"

8
scripts/domino-enum-users.nse
View File

@@ -22,8 +22,8 @@ Attempts to discover valid IBM Lotus Domino users and download their ID files by
-- |_ Successfully stored "MJacksson" in /tmp/MJacksson.id
--
--
-- @args domino-id.path the location to which any retrieved ID files are stored
-- @args domino-id.username the name of the user from which to retrieve the ID.
-- @args domino-enum-users.path the location to which any retrieved ID files are stored
-- @args domino-enum-users.username the name of the user from which to retrieve the ID.
-- If this parameter is not specified, the unpwdb
-- library will be used to brute force names of users.
--
@@ -70,11 +70,11 @@ action = function(host, port)
local helper = nrpc.Helper:new( host, port )
local status, data, usernames, err
local path = stdnse.get_script_args('domino-enum-users.path')
local path = stdnse.get_script_args(SCRIPT_NAME .. ".path")
local result = {}
local save_file = false
local counter = 0
local domino_username = stdnse.get_script_args("domino-enum-users.username")
local domino_username = stdnse.get_script_args(SCRIPT_NAME .. ".username")
if ( domino_username ) then
usernames = ( function()
local b = true

2
scripts/ftp-brute.nse
View File

@@ -23,7 +23,7 @@ Based on old ftp-brute.nse script by Diman Todorov, Vlatko Kosturjak and Ron Bow
-- @output
-- PORT STATE SERVICE
-- 21/tcp open ftp
-- | my-ftp-brute:
-- | ftp-brute:
-- | Accounts
-- | root:root - Valid credentials
-- | Statistics

2
scripts/ftp-vsftpd-backdoor.nse
View File

@@ -24,7 +24,7 @@ References:
-- @usage
-- nmap --script ftp-vsftpd-backdoor -p 21 <host>
--
-- @args exploit.cmd or ftp-vsftpd-backdoor.cmd Command to execute in shell
-- @args ftp-vsftpd-backdoor.cmd Command to execute in shell
-- (default is <code>id</code>).
--
-- @output

2
scripts/http-cookie-flags.nse
View File

@@ -16,7 +16,7 @@ by it will be checked in addition to the root.
--
-- @output
-- 443/tcp open https
-- | http-session-cookie-flags:
-- | http-cookie-flags:
-- | /:
-- | PHPSESSID:
-- | secure flag not set and HTTPS in use

3
scripts/http-devframework.nse
View File

@@ -26,10 +26,11 @@ Note that the <code>consumingDetect</code> callback will not take place only if
---
-- @usage nmap -p80 --script http-devframework.nse <target>
--
-- @args http-errors.rapid boolean value that determines if a rapid detection
-- @args http-devframework.rapid boolean value that determines if a rapid detection
-- should take place. The main difference of a rapid vs a lengthy detection
-- is that second one requires crawling through the website. Default: false
-- (lengthy detection is performed)
-- @args http-devframework.fingerprintfile File containing fingerprints. Default: nselib/data/http-devframework-fingerprints.lua
--
-- @output
-- PORT STATE SERVICE REASON

37
scripts/http-domino-enum-passwords.nse
View File

@@ -30,12 +30,12 @@ and password or indirectly from results of http-brute or http-form-brute.
---
-- @usage
-- nmap --script domino-enum-passwords -p 80 <host> --script-args domino-enum-passwords.username='patrik karlsson',domino-enum-passwords.password=secret
-- nmap --script http-domino-enum-passwords -p 80 <host> --script-args http-domino-enum-passwords.username='patrik karlsson',http-domino-enum-passwords.password=secret
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | domino-enum-passwords:
-- | http-domino-enum-passwords:
-- | Information
-- | Information retrieved as: "Jim Brass"
-- | Internet hashes (salted, jtr: --format=DOMINOSEC)
@@ -64,17 +64,19 @@ and password or indirectly from results of http-brute or http-form-brute.
-- | Nick Stokes ID File has been downloaded (/tmp/id/Nick Stokes.id)
-- | Catherine Willows ID File has been downloaded (/tmp/id/Catherine Willows.id)
-- |
-- |_ Results limited to 10 results (see domino-enum-passwords.count)
-- |_ Results limited to 10 results (see http-domino-enum-passwords.count)
--
--
-- @args domino-enum-passwords.path points to the path protected by authentication
-- @args domino-enum-passwords.hostname sets the host header in case of virtual hosting
-- @args domino-enum-passwords.count the number of internet hashes and id files to fetch.
-- @args http-domino-enum-passwords.path points to the path protected by
-- authentication. Default:"/names.nsf/People?OpenView"
-- @args http-domino-enum-passwords.hostname sets the host header in case of virtual hosting.
-- Not needed if target is specified by name.
-- @args http-domino-enum-passwords.count the number of internet hashes and id files to fetch.
-- If a negative value is given, all hashes and id files are retrieved (default: 10)
-- @args domino-enum-passwords.idpath the path where downloaded ID files should be saved
-- @args http-domino-enum-passwords.idpath the path where downloaded ID files should be saved
-- If not given, the script will only indicate if the ID file is donwloadable or not
-- @args domino-enum-passwords.username Username for HTTP auth, if required
-- @args domino-enum-passwords.password Password for HTTP auth, if required
-- @args http-domino-enum-passwords.username Username for HTTP auth, if required
-- @args http-domino-enum-passwords.password Password for HTTP auth, if required
--
-- Version 0.4
@@ -212,15 +214,15 @@ local function fail (err) return stdnse.format_output(false, err) end
action = function(host, port)
local path = "/names.nsf"
local download_path = stdnse.get_script_args('domino-enum-passwords.idpath')
local vhost= stdnse.get_script_args('domino-enum-passwords.hostname')
local user = stdnse.get_script_args('domino-enum-passwords.username')
local pass = stdnse.get_script_args('domino-enum-passwords.password')
local path = stdnse.get_script_args(SCRIPT_NAME .. '.path') or "/names.nsf/People?OpenView"
local download_path = stdnse.get_script_args(SCRIPT_NAME .. '.idpath')
local vhost= stdnse.get_script_args(SCRIPT_NAME .. '.hostname')
local user = stdnse.get_script_args(SCRIPT_NAME .. '.username')
local pass = stdnse.get_script_args(SCRIPT_NAME .. '.password')
local pos, pager
local links, result, hashes,legacyHashes, id_files = {}, {}, {}, {},{}
local chunk_size = 30
local max_fetch = tonumber(stdnse.get_script_args('domino-enum-passwords.count')) or 10
local max_fetch = tonumber(stdnse.get_script_args(SCRIPT_NAME .. '.count')) or 10
local http_response
local has_creds = false
-- authentication required?
@@ -242,12 +244,11 @@ action = function(host, port)
end
if not pass then
local msg = has_creds and "No valid credentials were found" or "No credentials supplied"
return fail(("%s (see domino-enum-passwords.username and domino-enum-passwords.password)"):format(msg))
return fail(("%s (see http-domino-enum-passwords.username and http-domino-enum-passwords.password)"):format(msg))
end
end
end
path = "/names.nsf/People?OpenView"
http_response = http.get( vhost or host, port, path, { auth = { username = user, password = pass }, no_cache = true })
if http_response.status and http_response.status ==200 then
pager = getPager( http_response.body )
@@ -346,7 +347,7 @@ action = function(host, port)
local result = stdnse.format_output(true, result)
if ( max_fetch > 0 ) then
result = result .. (" \n Results limited to %d results (see domino-enum-passwords.count)"):format(max_fetch)
result = result .. (" \n Results limited to %d results (see http-domino-enum-passwords.count)"):format(max_fetch)
end
return result

2
scripts/http-form-brute.nse
View File

@@ -53,7 +53,7 @@ the following rules:
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-brute:
-- | http-form-brute:
-- | Accounts
-- | Patrik Karlsson:secret - Valid credentials
-- | Statistics

2
scripts/http-gitweb-projects-enum.nse
View File

@@ -25,7 +25,7 @@ Retrieves a list of Git projects, owners and descriptions from a gitweb (web int
-- | Number of projects: 172
-- |_ Number of owners: 42
--
-- @args http-gitweb.projects-enum.path specifies the location of gitweb
-- @args http-gitweb-projects-enum.path specifies the location of gitweb
-- (default: /)
author = "riemann"

2
scripts/http-grep.nse
View File

@@ -71,7 +71,7 @@ The script searches for email and ip by default.
-- @args http-grep.withindomain only spider URLs within the same
-- domain. This widens the scope from <code>withinhost</code> and can
-- not be used in combination. (default: false)
-- @args http.breakonmatch Returns output if there is a match for a single pattern type.
-- @args http-grep.breakonmatch Returns output if there is a match for a single pattern type.
-- @args http-grep.builtins supply a single or a list of built in types. supports email, phone, mastercard, discover,
-- visa, amex, ssn and ip addresses. If you just put in script-args http-grep.builtins then all will be enabled.
--

3
scripts/http-open-proxy.nse
View File

@@ -15,9 +15,6 @@ the target to retrieve a web page from www.google.com.
]]
---
-- @args proxy.url Url that will be requested to the proxy
-- @args proxy.pattern Pattern that will be searched inside the request results
--
-- @usage
-- nmap --script http-open-proxy.nse \
-- --script-args proxy.url=<url>,proxy.pattern=<pattern>

9
scripts/http-userdir-enum.nse
View File

@@ -26,8 +26,8 @@ CVE-2001-1013: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-1013.
]]
---
-- @args userdir.users The filename of a username list.
-- @args limit The maximum number of users to check.
-- @args http-userdir-enum.users The filename of a username list.
-- @args http-userdir-enum.limit The maximum number of users to check.
--
-- @output
-- 80/tcp open http syn-ack Apache httpd 2.2.9
@@ -44,6 +44,7 @@ portrule = shortport.http
local function fail (err) return stdnse.format_output(false, err) end
action = function(host, port)
local limit = stdnse.get_script_args(SCRIPT_NAME .. '.limit')
if(not nmap.registry.userdir) then
init()
@@ -117,9 +118,7 @@ end
-- @return nil
function init()
local customlist = nmap.registry.args.users or
(nmap.registry.args.userdir and nmap.registry.args.userdir.users) or
stdnse.get_script_args('userdir.users')
local customlist = stdnse.get_script_args(SCRIPT_NAME .. '.users')
local read, usernames = datafiles.parse_file(customlist or "nselib/data/usernames.lst", {})
if not read then
stdnse.debug1("%s", usernames or "Unknown Error reading usernames list.")

8
scripts/informix-tables.nse
View File

@@ -43,8 +43,8 @@ Retrieves a list of tables and column definitions for each database on an Inform
-- | warehouses warehouse_name 4
-- |_ warehouses warehouse_spec 4
--
-- @args informix-query.username The username used for authentication
-- @args informix-query.password The password used for authentication
-- @args informix-tables.username The username used for authentication
-- @args informix-tables.password The password used for authentication
--
-- Version 0.1
-- Created 27/07/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
@@ -63,8 +63,8 @@ action = function( host, port )
local helper
local status, data
local result, output = {}, {}
local user = stdnse.get_script_args('informix-tables.username')
local pass = stdnse.get_script_args('informix-tables.password') or ""
local user = stdnse.get_script_args(SCRIPT_NAME .. '.username')
local pass = stdnse.get_script_args(SCRIPT_NAME .. '.password') or ""
local query= [[
SELECT cast(tabname as char(20)) table, cast(colname as char(20)) column, cast( cast(nrows as int) as char(20)) rows
FROM "informix".systables st, "informix".syscolumns sc

2
scripts/llmnr-resolve.nse
View File

@@ -31,7 +31,7 @@ For more information, see:
--
--@output
-- Pre-scan script results:
-- | llmnr-query:
-- | llmnr-resolve:
-- | acer-PC : 192.168.1.4
-- |_ Use the newtargets script-arg to add the results as targets
--

2
scripts/lltd-discovery.nse
View File

@@ -23,7 +23,7 @@ http://www.microsoft.com/whdc/connect/Rally/LLTD-spec.mspx
-- nmap -e <interface> --script lltd-discovery
--
-- @args lltd-discovery.interface string specifying which interface to do lltd discovery on. If not specified, all ethernet interfaces are tried.
-- @args lltd-discover.timeout timespec specifying how long to listen for replies (default 30s)
-- @args lltd-discovery.timeout timespec specifying how long to listen for replies (default 30s)
--
-- @output
-- | lltd-discovery:

2
scripts/mikrotik-routeros-brute.nse
View File

@@ -18,7 +18,7 @@ Additional information:
-- | Statistics
-- |_ Performed 60 guesses in 602 seconds, average tps: 0
--
-- @args mikrotik-routerous-brute.threads sets the number of threads. Default: 1
-- @args mikrotik-routeros-brute.threads sets the number of threads. Default: 1
--
---

4
scripts/rdp-vuln-ms12-020.nse
View File

@@ -33,12 +33,12 @@ Original check by by Worawit Wang (sleepya).
---
-- @usage
-- nmap -sV --script=rdp-ms12-020 -p 3389 <target>
-- nmap -sV --script=rdp-vuln-ms12-020 -p 3389 <target>
--
-- @output
-- PORT STATE SERVICE VERSION
-- 3389/tcp open ms-wbt-server?
-- | rdp-ms12-020:
-- | rdp-vuln-ms12-020:
-- | VULNERABLE:
-- | MS12-020 Remote Desktop Protocol Denial Of Service Vulnerability
-- | State: VULNERABLE

2
scripts/rmi-dumpregistry.nse
View File

@@ -25,7 +25,7 @@ so-called "Custom data".
]]
---
-- @usage nmap --script "rmi-dumpregistry.nse" -p 1098 <host>
-- @usage nmap --script rmi-dumpregistry -p 1098 <host>
-- @output
-- PORT STATE SERVICE REASON
-- 1099/tcp open java-rmi syn-ack

2
scripts/rmi-vuln-classloader.nse
View File

@@ -24,7 +24,7 @@ References:
-- @output
-- PORT STATE SERVICE
-- 1099/tcp open rmiregistry
-- | rmi-vuln:
-- | rmi-vuln-classloader:
-- | VULNERABLE:
-- | RMI registry default configuration remote code execution vulnerability
-- | State: VULNERABLE

1
scripts/smtp-vuln-cve2010-4344.nse
View File

@@ -57,7 +57,6 @@ Reference:
-- | Before 'id': uid=121(Debian-exim) gid=128(Debian-exim) groups=128(Debian-exim),45(sasl)
-- |_ After 'id': uid=0(root) gid=128(Debian-exim) groups=0(root)
--
-- @args smtp.domain Define the domain to be used in the SMTP EHLO command.
-- @args smtp-vuln-cve2010-4344.exploit The script will force the checks,
-- and will try to exploit the Exim SMTP server.
-- @args smtp-vuln-cve2010-4344.mailfrom Define the source email address to

2
scripts/smtp-vuln-cve2011-1720.nse
View File

@@ -40,8 +40,6 @@ Reference:
-- | http://www.postfix.org/CVE-2011-1720.html
-- | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1720
-- |_ http://osvdb.org/72259
--
-- @args smtp.domain Define the domain to be used in the SMTP EHLO command.
author = "Djalal Harouni"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"

1
scripts/smtp-vuln-cve2011-1764.nse
View File

@@ -44,7 +44,6 @@ Reference:
-- | http://osvdb.org/72156
-- |_ http://bugs.exim.org/show_bug.cgi?id=1106
--
-- @args smtp.domain Define the domain to be used in the SMTP EHLO command.
-- @args smtp-vuln-cve2011-1764.mailfrom Define the source email address to
-- be used.
-- @args smtp-vuln-cve2011-1764.mailto Define the destination email address

2
scripts/socks-open-proxy.nse
View File

@@ -16,8 +16,6 @@ different test host can be passed as <code>proxy.url</code>
argument.
]]
---
--@args proxy.url URL that will be requested to the proxy.
--@args proxy.pattern Pattern that will be searched inside the request results.
--@output
-- PORT STATE SERVICE
-- 1080/tcp open socks

2
scripts/tftp-enum.nse
View File

@@ -24,7 +24,7 @@ http://code.google.com/p/tftptheft/.
]]
---
-- @usage nmap -sU -p 69 --script tftp-enum.nse --script-args="tftp-enum.filelist=customlist.txt" <host>
-- @usage nmap -sU -p 69 --script tftp-enum.nse --script-args tftp-enum.filelist=customlist.txt <host>
--
-- @args filelist - file name with list of filenames to enumerate at tftp server
--

2
scripts/tn3270-screen.nse
View File

@@ -42,7 +42,7 @@ Hidden fields will be listed below the screen with (row, col) coordinates.
-- |
-- |_Your IP(10.10.10.375 :64199), SNA LU( ) 05/30/15 13:33:37
--
-- @args tn3270.commands a semi-colon separated list of commands you want to
-- @args tn3270-screen.commands a semi-colon separated list of commands you want to
-- issue before printing the screen
--
--

5
scripts/xmlrpc-methods.nse
View File

@@ -15,11 +15,10 @@ of system.methodHelp for each method returned by listMethods.
]]
---
-- @usage nmap xmlrpc-info <target>
--
-- @args xmlrpc-info.url The URI path to request.
-- @args xmlrpc-methods.url The URI path to request.
--
-- @output
-- | xmlrpc-methods:
-- | Supported Methods:
-- | list
-- | system.listMethods