PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Re-indent some scripts. Whitespace-only commit

Browse Source 
https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
dmiller
2014-01-31 17:36:09 +00:00
parent bcf991c128
commit 298be5bfaa
50 changed files with 3296 additions and 3296 deletions
Download Patch File Download Diff File Expand all files Collapse all files

136
scripts/http-open-redirect.nse
View File

@@ -44,94 +44,94 @@ categories = {"discovery", "intrusive"}
portrule = shortport.http
local function dbg(str,...)
stdnse.print_debug(2,"http-open-redirect:"..str, ...)
stdnse.print_debug(2,"http-open-redirect:"..str, ...)
end
local function dbgt(tbl)
for k,v in pairs(tbl) do
dbg(" %s = %s " , tostring(k), tostring(v))
end
for k,v in pairs(tbl) do
dbg(" %s = %s " , tostring(k), tostring(v))
end
end
local function getHostPort(parsed)
local host, port = parsed.host, parsed.port
-- if no port was found, try to deduce it from the scheme
if ( not(port) ) then
port = (parsed.scheme == 'https') and 443
port = port or ((parsed.scheme == 'http') and 80)
end
return host, port
local host, port = parsed.host, parsed.port
-- if no port was found, try to deduce it from the scheme
if ( not(port) ) then
port = (parsed.scheme == 'https') and 443
port = port or ((parsed.scheme == 'http') and 80)
end
return host, port
end
local function isRedirect(status)
return status >= 300 and status <=399
return status >= 300 and status <=399
end
-- This function checks if any query parameter was used as a forward destination
-- @return false or a new query string to test
local function checkLocationEcho(query, destination)
dbg("checkLocationEcho(%s, %s)", tostring(query), tostring(destination))
local q = url.parse_query(query);
-- Check the values (and keys) and see if they are reflected in the location header
for k,v in pairs(q) do
local s,f = string.find(destination, v)
if s == 1 then
-- Build a new URL
q[k] = "http%3A%2f%2fscanme.nmap.org%2f";
return url.build_query(q)
end
end
return false;
dbg("checkLocationEcho(%s, %s)", tostring(query), tostring(destination))
local q = url.parse_query(query);
-- Check the values (and keys) and see if they are reflected in the location header
for k,v in pairs(q) do
local s,f = string.find(destination, v)
if s == 1 then
-- Build a new URL
q[k] = "http%3A%2f%2fscanme.nmap.org%2f";
return url.build_query(q)
end
end
return false;
end
action = function(host, port)
local crawler = httpspider.Crawler:new(host, port, nil, { scriptname = SCRIPT_NAME, redirect_ok = false } )
crawler:set_timeout(10000)
local crawler = httpspider.Crawler:new(host, port, nil, { scriptname = SCRIPT_NAME, redirect_ok = false } )
crawler:set_timeout(10000)
local results = {}
while(true) do
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(true, "ERROR: %s", r.reason)
else
break
end
end
local response = r.response
-- Was it a redirect?
if response and response.header and response.header.location and isRedirect(response.status) then
-- Were any parameters involved?
local parsed = url.parse(tostring(r.url));
local results = {}
while(true) do
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(true, "ERROR: %s", r.reason)
else
break
end
end
local response = r.response
-- Was it a redirect?
if response and response.header and response.header.location and isRedirect(response.status) then
-- Were any parameters involved?
local parsed = url.parse(tostring(r.url));
-- We are only interested in links which have parameters
if parsed.query and #parsed.query > 0 then
-- Now we need to check if any of the parameters were echoed in the location-header
local destination = response.header.location
local newQuery = checkLocationEcho(parsed.query, destination)
--dbg("newQuery: %s" , tostring(newQuery))
if newQuery then
local host, port = getHostPort(parsed);
local ppath = url.parse_path(parsed.path or "")
local url = url.build_path(ppath)
if parsed.params then url = url .. ";" .. parsed.params end
url = url .. "?" .. newQuery
dbg("Checking potential open redirect: %s:%s%s", host,port,url);
local testResponse = http.get(host, port, url);
--dbgt(testResponse)
if isRedirect(testResponse.status) and testResponse.header.location == "http://scanme.nmap.org/" then
table.insert(results, ("%s://%s:%s%s"):format(parsed.scheme, host, port,url))
end
end
end
end
-- We are only interested in links which have parameters
if parsed.query and #parsed.query > 0 then
-- Now we need to check if any of the parameters were echoed in the location-header
local destination = response.header.location
local newQuery = checkLocationEcho(parsed.query, destination)
--dbg("newQuery: %s" , tostring(newQuery))
if newQuery then
local host, port = getHostPort(parsed);
local ppath = url.parse_path(parsed.path or "")
local url = url.build_path(ppath)
if parsed.params then url = url .. ";" .. parsed.params end
url = url .. "?" .. newQuery
dbg("Checking potential open redirect: %s:%s%s", host,port,url);
local testResponse = http.get(host, port, url);
--dbgt(testResponse)
if isRedirect(testResponse.status) and testResponse.header.location == "http://scanme.nmap.org/" then
table.insert(results, ("%s://%s:%s%s"):format(parsed.scheme, host, port,url))
end
end
end
end
end
if ( #results> 0 ) then
return stdnse.format_output(true, results)
end
end
if ( #results> 0 ) then
return stdnse.format_output(true, results)
end
end