mirror of
https://github.com/nmap/nmap.git
synced 2025-12-09 06:01:28 +00:00
Final re-indent for scripts.
This commit is contained in:
@@ -212,7 +212,7 @@ local function BOcrypt(data, password, initial_seed )
|
||||
end
|
||||
|
||||
local function BOpack(type_packet, str1, str2)
|
||||
-- create BO packet
|
||||
-- create BO packet
|
||||
local data = ""
|
||||
local size = #MAGICSTRING + 4*2 + 3 + #str1 + #str2
|
||||
data = bin.pack("A<IICACAC",MAGICSTRING,size,g_packet,type_packet,str1,0x00,str2,0x00)
|
||||
|
||||
@@ -341,10 +341,10 @@ local function enum(host, port, domain)
|
||||
changed = true
|
||||
end
|
||||
end
|
||||
-- if changed then
|
||||
-- stdnse.print_debug("break[]")
|
||||
--if changed then
|
||||
-- stdnse.print_debug("break[]")
|
||||
--break
|
||||
-- end
|
||||
-- end
|
||||
end
|
||||
elseif a > b then -- ][ range
|
||||
if hash > a or hash < b then
|
||||
|
||||
@@ -313,26 +313,26 @@ local function get_fingerprints(fingerprint_file, category)
|
||||
end
|
||||
|
||||
|
||||
-- -- If the user wants to try variations, add them
|
||||
-- if(try_variations) then
|
||||
-- -- Get a list of all variations for this directory
|
||||
-- local variations = get_variations(entry['checkdir'])
|
||||
--
|
||||
-- -- Make a copy of the entry for each of them
|
||||
-- for _, variation in ipairs(variations) do
|
||||
-- new_entry = {}
|
||||
-- for k, v in pairs(entry) do
|
||||
-- new_entry[k] = v
|
||||
-- end
|
||||
-- new_entry['checkdesc'] = new_entry['checkdesc'] .. " (variation)"
|
||||
-- new_entry['checkdir'] = variation
|
||||
-- table.insert(entries, new_entry)
|
||||
-- count = count + 1
|
||||
-- end
|
||||
-- end
|
||||
-- -- If the user wants to try variations, add them
|
||||
-- if(try_variations) then
|
||||
-- -- Get a list of all variations for this directory
|
||||
-- local variations = get_variations(entry['checkdir'])
|
||||
--
|
||||
-- -- Make a copy of the entry for each of them
|
||||
-- for _, variation in ipairs(variations) do
|
||||
-- new_entry = {}
|
||||
-- for k, v in pairs(entry) do
|
||||
-- new_entry[k] = v
|
||||
-- end
|
||||
-- new_entry['checkdesc'] = new_entry['checkdesc'] .. " (variation)"
|
||||
-- new_entry['checkdir'] = variation
|
||||
-- table.insert(entries, new_entry)
|
||||
-- count = count + 1
|
||||
-- end
|
||||
-- end
|
||||
|
||||
-- Cache the fingerprints for other scripts, so we aren't reading the files every time
|
||||
-- nmap.registry.http_fingerprints = fingerprints
|
||||
-- nmap.registry.http_fingerprints = fingerprints
|
||||
|
||||
return true, fingerprints
|
||||
end
|
||||
@@ -345,8 +345,8 @@ action = function(host, port)
|
||||
local displayall = stdnse.get_script_args({'http-enum.displayall', 'displayall'}) or false
|
||||
local fingerprint_file = stdnse.get_script_args({'http-enum.fingerprintfile', 'fingerprints'}) or 'http-fingerprints.lua'
|
||||
local category = stdnse.get_script_args('http-enum.category')
|
||||
-- local try_variations = stdnse.get_script_args({'http-enum.tryvariations', 'variations'}) or false
|
||||
-- local limit = tonumber(stdnse.get_script_args({'http-enum.limit', 'limit'})) or -1
|
||||
-- local try_variations = stdnse.get_script_args({'http-enum.tryvariations', 'variations'}) or false
|
||||
-- local limit = tonumber(stdnse.get_script_args({'http-enum.limit', 'limit'})) or -1
|
||||
|
||||
-- Add URLs from external files
|
||||
local status, fingerprints = get_fingerprints(fingerprint_file, category)
|
||||
|
||||
@@ -82,7 +82,7 @@ payloads = { { filename = "1.php", content = "<?php echo 123456 + 654321; ?>", c
|
||||
-- { filename = "1.sh", content = "echo 123456 + 654321", check = "777777" },
|
||||
-- { filename = "1.jsp", content = "<%= 123456 + 654321 %>", check = "777777" },
|
||||
-- { filename = "1.asp", content = "<%= 123456 + 654321 %>", check = "777777" },
|
||||
}
|
||||
}
|
||||
|
||||
listofrequests = {}
|
||||
|
||||
|
||||
@@ -570,16 +570,16 @@ local wafs = {
|
||||
ciscoacexml = ciscoacexml,
|
||||
modsecurity = modsecurity,
|
||||
naxsi = naxsi,
|
||||
-- netcontinuum = netcontinuum,
|
||||
-- secureiis = secureiis,
|
||||
-- urlscan = urlscan,
|
||||
-- beeware = beeware,
|
||||
-- hyperguard = hyperguard,
|
||||
-- websecurity = websecurity,
|
||||
-- imperva = imperva,
|
||||
-- ibmwas = ibmwas,
|
||||
-- nevisProxy = nevisProxy,
|
||||
-- genericwaf = genericwaf,
|
||||
-- netcontinuum = netcontinuum,
|
||||
-- secureiis = secureiis,
|
||||
-- urlscan = urlscan,
|
||||
-- beeware = beeware,
|
||||
-- hyperguard = hyperguard,
|
||||
-- websecurity = websecurity,
|
||||
-- imperva = imperva,
|
||||
-- ibmwas = ibmwas,
|
||||
-- nevisProxy = nevisProxy,
|
||||
-- genericwaf = genericwaf,
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -81,19 +81,19 @@ end
|
||||
|
||||
--- Gets a raw ethernet buffer with LLTD information and returns the responding host's IP and MAC
|
||||
local parseHello = function(data)
|
||||
-- HelloMsg = [
|
||||
-- ethernet_hdr = [mac_dst(6), mac_src(6), protocol(2)],
|
||||
-- lltd_demultiplex_hdr = [version(1), type_of_service(1), reserved(1), function(1)],
|
||||
-- base_hdr = [mac_dst(6), mac_src(6), seq_no(2)],
|
||||
-- up_hello_hdr = [ generation_number(2), current_mapper_address(6), apparent_mapper_address(6), tlv_list(var) ]
|
||||
--]
|
||||
-- HelloMsg = [
|
||||
-- ethernet_hdr = [mac_dst(6), mac_src(6), protocol(2)],
|
||||
-- lltd_demultiplex_hdr = [version(1), type_of_service(1), reserved(1), function(1)],
|
||||
-- base_hdr = [mac_dst(6), mac_src(6), seq_no(2)],
|
||||
-- up_hello_hdr = [ generation_number(2), current_mapper_address(6), apparent_mapper_address(6), tlv_list(var) ]
|
||||
--]
|
||||
|
||||
--HelloStruct = {
|
||||
-- mac_src,
|
||||
-- sequence_number,
|
||||
-- generation_number,
|
||||
-- tlv_list(dict)
|
||||
--}
|
||||
--HelloStruct = {
|
||||
-- mac_src,
|
||||
-- sequence_number,
|
||||
-- generation_number,
|
||||
-- tlv_list(dict)
|
||||
--}
|
||||
local types = {"Host ID", "Characteristics", "Physical Medium", "Wireless Mode", "802.11 BSSID",
|
||||
"802.11 SSID", "IPv4 Address", "IPv6 Address", "802.11 Max Operational Rate",
|
||||
"Performance Counter Frequency", nil, "Link Speed", "802.11 RSSI", "Icon Image", "Machine Name",
|
||||
|
||||
@@ -432,7 +432,7 @@ local function p2p_create_packet(protocol, do_encryption)
|
||||
-- Set a couple flags that we need (we don't send any optional data)
|
||||
flags = bit.bor(flags, mode_flags.FLAG_MODE)
|
||||
flags = bit.bor(flags, mode_flags.FLAG_ENCODED)
|
||||
-- flags = bit.bor(flags, mode_flags.FLAG_LOCAL_ACK)
|
||||
-- flags = bit.bor(flags, mode_flags.FLAG_LOCAL_ACK)
|
||||
-- Set the special TCP flag
|
||||
if(protocol == "tcp") then
|
||||
flags = bit.bor(flags, mode_flags.FLAG_IS_TCP)
|
||||
|
||||
@@ -8,22 +8,22 @@ local tab = require "tab"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Repeatedly probe open and/or closed ports on a host to obtain a series
|
||||
of round-trip time values for each port. These values are used to
|
||||
group collections of ports which are statistically different from other
|
||||
groups. Ports being in different groups (or "families") may be due to
|
||||
network mechanisms such as port forwarding to machines behind a NAT.
|
||||
Repeatedly probe open and/or closed ports on a host to obtain a series
|
||||
of round-trip time values for each port. These values are used to
|
||||
group collections of ports which are statistically different from other
|
||||
groups. Ports being in different groups (or "families") may be due to
|
||||
network mechanisms such as port forwarding to machines behind a NAT.
|
||||
|
||||
In order to group these ports into different families, some statistical
|
||||
values must be computed. Among these values are the mean and standard
|
||||
deviation of the round-trip times for each port. Once all of the times
|
||||
have been recorded and these values have been computed, the Student's
|
||||
t-test is used to test the statistical significance of the differences
|
||||
between each port's data. Ports which have round-trip times that are
|
||||
statistically the same are grouped together in the same family.
|
||||
In order to group these ports into different families, some statistical
|
||||
values must be computed. Among these values are the mean and standard
|
||||
deviation of the round-trip times for each port. Once all of the times
|
||||
have been recorded and these values have been computed, the Student's
|
||||
t-test is used to test the statistical significance of the differences
|
||||
between each port's data. Ports which have round-trip times that are
|
||||
statistically the same are grouped together in the same family.
|
||||
|
||||
This script is based on Doug Hoyte's Qscan documentation and patches
|
||||
for Nmap.
|
||||
This script is based on Doug Hoyte's Qscan documentation and patches
|
||||
for Nmap.
|
||||
]]
|
||||
|
||||
-- See http://hcsw.org/nmap/QSCAN for more on Doug's research
|
||||
|
||||
@@ -358,7 +358,7 @@ local function check_login(hostinfo, username, password, logintype)
|
||||
end
|
||||
end
|
||||
|
||||
--io.write(string.format("Result: %s\n\n", result_strings[result]))
|
||||
--io.write(string.format("Result: %s\n\n", result_strings[result]))
|
||||
|
||||
return result
|
||||
end
|
||||
@@ -1010,15 +1010,15 @@ local function go(host)
|
||||
-- based on the username
|
||||
if(temp_password == USERNAME) then
|
||||
password = username
|
||||
--io.write(string.format("Trying matching username/password (%s:%s)\n", username, password))
|
||||
--io.write(string.format("Trying matching username/password (%s:%s)\n", username, password))
|
||||
elseif(temp_password == USERNAME_REVERSED) then
|
||||
password = string.reverse(username)
|
||||
--io.write(string.format("Trying reversed username/password (%s:%s)\n", username, password))
|
||||
--io.write(string.format("Trying reversed username/password (%s:%s)\n", username, password))
|
||||
else
|
||||
password = temp_password
|
||||
end
|
||||
|
||||
--io.write(string.format("%s:%s\n", username, password))
|
||||
--io.write(string.format("%s:%s\n", username, password))
|
||||
local result = check_login(hostinfo, username, password, get_type(hostinfo))
|
||||
|
||||
-- Check if the username was locked out
|
||||
@@ -1080,7 +1080,7 @@ end
|
||||
|
||||
--_G.TRACEBACK = TRACEBACK or {}
|
||||
action = function(host)
|
||||
-- TRACEBACK[coroutine.running()] = true;
|
||||
-- TRACEBACK[coroutine.running()] = true;
|
||||
|
||||
local status, result
|
||||
local response = {}
|
||||
|
||||
@@ -172,7 +172,7 @@ function check_ms08_067(host)
|
||||
end
|
||||
|
||||
-- Call netpathcanonicalize
|
||||
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
|
||||
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
|
||||
|
||||
local path1 = "\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\..\\n"
|
||||
local path2 = "\\n"
|
||||
@@ -198,7 +198,7 @@ end
|
||||
-- Help messages for the more common errors seen by the Conficker check.
|
||||
CONFICKER_ERROR_HELP = {
|
||||
["NT_STATUS_BAD_NETWORK_NAME"] =
|
||||
[[UNKNOWN; Network name not found (required service has crashed). (Error NT_STATUS_BAD_NETWORK_NAME)]],
|
||||
[[UNKNOWN; Network name not found (required service has crashed). (Error NT_STATUS_BAD_NETWORK_NAME)]],
|
||||
-- http://seclists.org/nmap-dev/2009/q1/0918.html "non-Windows boxes (Samba on Linux/OS X, or a printer)"
|
||||
-- http://www.skullsecurity.org/blog/?p=209#comment-156
|
||||
-- "That means either it isn’t a Windows machine, or the service is
|
||||
@@ -212,7 +212,7 @@ CONFICKER_ERROR_HELP = {
|
||||
-- On these systems, if you reenable the browser service, then the
|
||||
-- test will complete."
|
||||
["NT_STATUS_OBJECT_NAME_NOT_FOUND"] =
|
||||
[[UNKNOWN; not Windows, or Windows with disabled browser service (CLEAN); or Windows with crashed browser service (possibly INFECTED).
|
||||
[[UNKNOWN; not Windows, or Windows with disabled browser service (CLEAN); or Windows with crashed browser service (possibly INFECTED).
|
||||
| If you know the remote system is Windows, try rebooting it and scanning
|
||||
|_ again. (Error NT_STATUS_OBJECT_NAME_NOT_FOUND)]],
|
||||
-- http://www.skullsecurity.org/blog/?p=209#comment-100
|
||||
@@ -221,7 +221,7 @@ CONFICKER_ERROR_HELP = {
|
||||
-- that neither does Conficker — NT_STATUS_ACCESS_DENIED probably
|
||||
-- means you’re ok."
|
||||
["NT_STATUS_ACCESS_DENIED"] =
|
||||
[[Likely CLEAN; access was denied.
|
||||
[[Likely CLEAN; access was denied.
|
||||
| If you have a login, try using --script-args=smbuser=xxx,smbpass=yyy
|
||||
| (replace xxx and yyy with your username and password). Also try
|
||||
|_ smbdomain=zzz if you know the domain. (Error NT_STATUS_ACCESS_DENIED)]],
|
||||
|
||||
@@ -266,7 +266,7 @@ end
|
||||
|
||||
--_G.TRACEBACK = TRACEBACK or {}
|
||||
action = function(host)
|
||||
-- TRACEBACK[coroutine.running()] = true;
|
||||
-- TRACEBACK[coroutine.running()] = true;
|
||||
|
||||
local response = {}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user