diff --git a/scripts/dns-fuzz.nse b/scripts/dns-fuzz.nse index f7d1a1644..9f2461856 100644 --- a/scripts/dns-fuzz.nse +++ b/scripts/dns-fuzz.nse @@ -1,5 +1,5 @@ description = [[ -This script launches a DNS fuzzing attack against any DNS server. +Launches a DNS fuzzing attack against DNS servers. The script induces errors into randomly generated but valid DNS packets. The packet template that we use includes one uncompressed and one diff --git a/scripts/http-axis2-dir-traversal.nse b/scripts/http-axis2-dir-traversal.nse index 7560b5217..a9958c151 100644 --- a/scripts/http-axis2-dir-traversal.nse +++ b/scripts/http-axis2-dir-traversal.nse @@ -1,5 +1,5 @@ description = [[ -http-axis2-dir-traversal exploits a directory traversal vulnerability in Apache Axis2 version 1.4.1 by sending a specially crafted request to the parameter xsd (OSVDB-59001). By default it will try to retrieve the configuration file of the Axis2 service '/conf/axis2.xml' using the path '/axis2/services/' to return the username and password of the admin account. +Exploits a directory traversal vulnerability in Apache Axis2 version 1.4.1 by sending a specially crafted request to the parameter xsd (OSVDB-59001). By default it will try to retrieve the configuration file of the Axis2 service '/conf/axis2.xml' using the path '/axis2/services/' to return the username and password of the admin account. To exploit this vulnerability we need to detect a valid service running on the installation so we extract it from /listServices before exploiting the directory traversal vulnerability. By default it will retrieve the configuration file, if you wish to retrieve other files you need to set the argument http-axis2-dir-traversal.file correctly to traverse to the file's directory. Ex. ../../../../../../../../../etc/issue diff --git a/scripts/http-default-accounts.nse b/scripts/http-default-accounts.nse index 09c9763d7..205803463 100644 --- a/scripts/http-default-accounts.nse +++ b/scripts/http-default-accounts.nse @@ -1,5 +1,5 @@ description = [[ -http-default-accounts tests for access with default credentials used by a variety of web applications and devices. +Tests for access with default credentials used by a variety of web applications and devices. It works similar to http-enum, we detect applications by matching known paths and launching a login routine using default credentials when found. This script depends on a fingerprint file containing the target's information: name, category, location paths, default credentials and login routine. diff --git a/scripts/http-google-malware.nse b/scripts/http-google-malware.nse index 424d717e1..6de1d3917 100644 --- a/scripts/http-google-malware.nse +++ b/scripts/http-google-malware.nse @@ -1,5 +1,5 @@ description = [[ -http-google-malware checks if hosts are on Google's blacklist of suspected malware and phishing servers. These lists are constantly updated and are part of Google's Safe Browsing service. +Checks if hosts are on Google's blacklist of suspected malware and phishing servers. These lists are constantly updated and are part of Google's Safe Browsing service. To do this the script queries the Google's Safe Browsing service and you need to have your own API key to access Google's Safe Browsing Lookup services. Sign up for yours at http://code.google.com/apis/safebrowsing/key_signup.html diff --git a/scripts/http-litespeed-sourcecode-download.nse b/scripts/http-litespeed-sourcecode-download.nse index 2c7bb857d..cbf18d394 100644 --- a/scripts/http-litespeed-sourcecode-download.nse +++ b/scripts/http-litespeed-sourcecode-download.nse @@ -1,5 +1,5 @@ description = [[ -http-litespeed-sourcecode-download.nse exploits a null-byte poisoning vulnerability in Litespeed Web Servers 4.0.x before 4.0.15 to retrieve the target script's source code by sending a HTTP request with a null byte followed by a .txt file extension (CVE-2010-2333). +Exploits a null-byte poisoning vulnerability in Litespeed Web Servers 4.0.x before 4.0.15 to retrieve the target script's source code by sending a HTTP request with a null byte followed by a .txt file extension (CVE-2010-2333). If the server is not vulnerable it returns an error 400. If index.php is not found, you may try /phpinfo.php which is also shipped with LiteSpeed Web Server. The attack payload looks like this: * /index.php\00.txt diff --git a/scripts/smb-psexec.nse b/scripts/smb-psexec.nse index 99bd6a240..50ae27a7c 100644 --- a/scripts/smb-psexec.nse +++ b/scripts/smb-psexec.nse @@ -1,5 +1,5 @@ description = [[ -This script implements remote process execution similar to the Sysinternals' psexec tool, +Implements remote process execution similar to the Sysinternals' psexec tool, allowing a user to run a series of programs on a remote machine and read the output. This is great for gathering information about servers, running the same tool on a range of system, or even installing a backdoor on a collection of computers.