PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Relax http.parse_form to allow forms without an action

Browse Source 
Patch from nnposter: http://seclists.org/nmap-dev/2014/q3/384
This commit is contained in:
dmiller
2014-09-18 03:38:23 +00:00
parent d518e2dbcb
commit 327496d50c
7 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/http-sql-injection.nse
View File

@@ -247,7 +247,7 @@ action = function(host, port)
for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain)
local path = r.url.path
if form then
if form and form.action then
local vulnerable_fields = check_form(form, host, port, path)
if #vulnerable_fields > 0 then
vulnerable_fields["name"] = "Form at path: "..path..", form's action: "..form["action"]..". Fields that might be vulnerable:"