PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-09 14:11:29 +00:00
Code Issues Projects Releases Wiki Activity

Relax http.parse_form to allow forms without an action

Browse Source 
Patch from nnposter: http://seclists.org/nmap-dev/2014/q3/384
This commit is contained in:
dmiller
2014-09-18 03:38:23 +00:00
parent d518e2dbcb
commit 327496d50c
7 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/http-rfi-spider.nse
View File

@@ -198,7 +198,7 @@ function action(host, port)
for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain)
local path = r.url.path
if form then
if form and form.action then
local vulnerable_fields = check_form(form, host, port, path)
if #vulnerable_fields > 0 then
vulnerable_fields["name"] = "Possible RFI in form at path: "..path..", action: "..form["action"].." for fields:"