diff --git a/nselib/http.lua b/nselib/http.lua index 9d2bcefeb..6ae6ee745 100644 --- a/nselib/http.lua +++ b/nselib/http.lua @@ -1914,8 +1914,6 @@ function parse_form(form) local form_action = string.match(form, '[Aa][Cc][Tt][Ii][Oo][Nn]=[\'"](.-)[\'"]') if form_action then parsed["action"] = form_action - else - return nil end -- determine if the form is using get or post diff --git a/scripts/http-csrf.nse b/scripts/http-csrf.nse index 449971ce6..095c5c9e3 100644 --- a/scripts/http-csrf.nse +++ b/scripts/http-csrf.nse @@ -134,7 +134,7 @@ action = function(host, port) form = http.parse_form(form) local resistant = false - if form then + if form and form.action then for _, field in ipairs(form['fields']) do -- First we check the field's name. diff --git a/scripts/http-fileupload-exploiter.nse b/scripts/http-fileupload-exploiter.nse index bc9ecd16c..04ff62e65 100644 --- a/scripts/http-fileupload-exploiter.nse +++ b/scripts/http-fileupload-exploiter.nse @@ -256,7 +256,7 @@ action = function(host, port) form = http.parse_form(form) - if form then + if form and form.action then local action_absolute = string.find(form["action"], "https*://") diff --git a/scripts/http-form-fuzzer.nse b/scripts/http-form-fuzzer.nse index daa34518d..69da08a0d 100644 --- a/scripts/http-form-fuzzer.nse +++ b/scripts/http-form-fuzzer.nse @@ -195,7 +195,7 @@ function action(host, port) local maxlen = target["maxlength"] or maxlen_global for _,form_plain in ipairs(all_forms) do local form = http.parse_form(form_plain) - if form then + if form and form.action then local affected_fields = fuzz_form(form, minlen, maxlen, host, port, path) if #affected_fields > 0 then affected_fields["name"] = "Path: "..path.." Action: "..form["action"] diff --git a/scripts/http-rfi-spider.nse b/scripts/http-rfi-spider.nse index e195652d9..767695c12 100644 --- a/scripts/http-rfi-spider.nse +++ b/scripts/http-rfi-spider.nse @@ -198,7 +198,7 @@ function action(host, port) for _,form_plain in ipairs(all_forms) do local form = http.parse_form(form_plain) local path = r.url.path - if form then + if form and form.action then local vulnerable_fields = check_form(form, host, port, path) if #vulnerable_fields > 0 then vulnerable_fields["name"] = "Possible RFI in form at path: "..path..", action: "..form["action"].." for fields:" diff --git a/scripts/http-sql-injection.nse b/scripts/http-sql-injection.nse index 583f25810..41c4cfa18 100644 --- a/scripts/http-sql-injection.nse +++ b/scripts/http-sql-injection.nse @@ -247,7 +247,7 @@ action = function(host, port) for _,form_plain in ipairs(all_forms) do local form = http.parse_form(form_plain) local path = r.url.path - if form then + if form and form.action then local vulnerable_fields = check_form(form, host, port, path) if #vulnerable_fields > 0 then vulnerable_fields["name"] = "Form at path: "..path..", form's action: "..form["action"]..". Fields that might be vulnerable:" diff --git a/scripts/http-stored-xss.nse b/scripts/http-stored-xss.nse index c4b98ec07..bff2cb436 100644 --- a/scripts/http-stored-xss.nse +++ b/scripts/http-stored-xss.nse @@ -202,7 +202,7 @@ action = function(host, port) form = http.parse_form(form) - if form then + if form and form.action then local action_absolute = string.find(form["action"], "https*://")