diff --git a/CHANGELOG b/CHANGELOG
index 857d7144b..978e7a1b4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
# Nmap Changelog ($Id$); -*-text-*-
+o [NSE] Changed http-brute so that it works against the root path
+ ("/") by default rather than always requiring the http-brute.path
+ script argument. [Fyodor]
+
o [NSE] Applied patch from Daniel Miller that fixes bug in several scripts and
libraries http://seclists.org/nmap-dev/2012/q2/593 [Daniel Miller]
diff --git a/scripts/http-brute.nse b/scripts/http-brute.nse
index d253dd775..3606601d8 100644
--- a/scripts/http-brute.nse
+++ b/scripts/http-brute.nse
@@ -5,6 +5,7 @@ local nmap = require "nmap"
local shortport = require "shortport"
local string = require "string"
local table = require "table"
+local stdnse = require "stdnse"
description = [[
Performs brute force password auditing against http basic authentication.
@@ -32,7 +33,7 @@ Performs brute force password auditing against http basic authentication.
-- x The Driver class contains the driver implementation used by the brute
-- library
--
--- @args http-brute.path points to the path protected by authentication
+-- @args http-brute.path points to the path protected by authentication (default: /.
-- @args http-brute.hostname sets the host header in case of virtual hosting
-- @args http-brute.method sets the HTTP method to use (default GET)
@@ -54,9 +55,9 @@ Driver = {
local o = {}
setmetatable(o, self)
self.__index = self
- o.host = nmap.registry.args['http-brute.hostname'] or host
+ o.host = stdnse.get_script_args("http-brute.hostname") or host
o.port = port
- o.path = nmap.registry.args['http-brute.path']
+ o.path = stdnse.get_script_args("http-brute.path") or "/"
o.method = method
return o
end,
@@ -107,8 +108,8 @@ Driver = {
action = function( host, port )
local status, result
- local path = nmap.registry.args['http-brute.path']
- local method = string.upper(nmap.registry.args['http-brute.method'] or "GET")
+ local path = stdnse.get_script_args("http-brute.path") or "/"
+ local method = string.upper(stdnse.get_script_args("http-brute.method") or "GET")
local engine = brute.Engine:new(Driver, host, port, method )
engine.options.script_name = SCRIPT_NAME