PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 12:41:29 +00:00
Code Issues Projects Releases Wiki Activity

Relax http.parse_form to allow forms without an action

Browse Source 
Patch from nnposter: http://seclists.org/nmap-dev/2014/q3/384
This commit is contained in:
dmiller
2014-09-18 03:38:23 +00:00
parent d518e2dbcb
commit 327496d50c
7 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nselib/http.lua
View File

@@ -1914,8 +1914,6 @@ function parse_form(form)
local form_action = string.match(form, '[Aa][Cc][Tt][Ii][Oo][Nn]=[\'"](.-)[\'"]') local form_action = string.match(form, '[Aa][Cc][Tt][Ii][Oo][Nn]=[\'"](.-)[\'"]')
if form_action then if form_action then
parsed["action"] = form_action parsed["action"] = form_action
else
return nil
end end
-- determine if the form is using get or post -- determine if the form is using get or post

2
scripts/http-csrf.nse
View File

@@ -134,7 +134,7 @@ action = function(host, port)
form = http.parse_form(form) form = http.parse_form(form)
local resistant = false local resistant = false
if form then if form and form.action then
for _, field in ipairs(form['fields']) do for _, field in ipairs(form['fields']) do
-- First we check the field's name. -- First we check the field's name.

2
scripts/http-fileupload-exploiter.nse
View File

@@ -256,7 +256,7 @@ action = function(host, port)
form = http.parse_form(form) form = http.parse_form(form)
if form then if form and form.action then
local action_absolute = string.find(form["action"], "https*://") local action_absolute = string.find(form["action"], "https*://")

2
scripts/http-form-fuzzer.nse
View File

@@ -195,7 +195,7 @@ function action(host, port)
local maxlen = target["maxlength"] or maxlen_global local maxlen = target["maxlength"] or maxlen_global
for _,form_plain in ipairs(all_forms) do for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain) local form = http.parse_form(form_plain)
if form then if form and form.action then
local affected_fields = fuzz_form(form, minlen, maxlen, host, port, path) local affected_fields = fuzz_form(form, minlen, maxlen, host, port, path)
if #affected_fields > 0 then if #affected_fields > 0 then
affected_fields["name"] = "Path: "..path.." Action: "..form["action"] affected_fields["name"] = "Path: "..path.." Action: "..form["action"]

2
scripts/http-rfi-spider.nse
View File

@@ -198,7 +198,7 @@ function action(host, port)
for _,form_plain in ipairs(all_forms) do for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain) local form = http.parse_form(form_plain)
local path = r.url.path local path = r.url.path
if form then if form and form.action then
local vulnerable_fields = check_form(form, host, port, path) local vulnerable_fields = check_form(form, host, port, path)
if #vulnerable_fields > 0 then if #vulnerable_fields > 0 then
vulnerable_fields["name"] = "Possible RFI in form at path: "..path..", action: "..form["action"].." for fields:" vulnerable_fields["name"] = "Possible RFI in form at path: "..path..", action: "..form["action"].." for fields:"

2
scripts/http-sql-injection.nse
View File

@@ -247,7 +247,7 @@ action = function(host, port)
for _,form_plain in ipairs(all_forms) do for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain) local form = http.parse_form(form_plain)
local path = r.url.path local path = r.url.path
if form then if form and form.action then
local vulnerable_fields = check_form(form, host, port, path) local vulnerable_fields = check_form(form, host, port, path)
if #vulnerable_fields > 0 then if #vulnerable_fields > 0 then
vulnerable_fields["name"] = "Form at path: "..path..", form's action: "..form["action"]..". Fields that might be vulnerable:" vulnerable_fields["name"] = "Form at path: "..path..", form's action: "..form["action"]..". Fields that might be vulnerable:"

2
scripts/http-stored-xss.nse
View File

@@ -202,7 +202,7 @@ action = function(host, port)
form = http.parse_form(form) form = http.parse_form(form)
if form then if form and form.action then
local action_absolute = string.find(form["action"], "https*://") local action_absolute = string.find(form["action"], "https*://")