PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-10 09:49:05 +00:00
Code Issues Projects Releases Wiki Activity

Fixes crash when using identify_404() that happened when the status response changes in the second or third request and the return value is the string "<unknown>".

Browse Source 
Previously, the library only checked for nil. Updated it to check the type of the response value and change it to -1 if its not a number to fix crash when passing a string to %d.
This commit is contained in:
paulino
2012-07-04 20:21:08 +00:00
parent 6b5d38ca8a
commit 469e6ca5ca
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
nselib/http.lua
View File

@@ -2152,10 +2152,12 @@ function identify_404(host, port)
return false, "Failed while testing for extra 404 error messages" return false, "Failed while testing for extra 404 error messages"
end end
-- Check if the return code became something other than 200 -- Check if the return code became something other than 200.
-- Status code: -1 represents unknown.
-- If the status is nil or the string "unknown" we switch to -1.
if(data2.status ~= 200) then if(data2.status ~= 200) then
if(data2.status == nil) then if(type(data2.status) ~= "number") then
data2.status = "<unknown>" data2.status = -1
end end
stdnse.print_debug(1, "HTTP: HTTP 404 status changed for second request (became %d).", data2.status) stdnse.print_debug(1, "HTTP: HTTP 404 status changed for second request (became %d).", data2.status)
return false, string.format("HTTP 404 status changed for second request (became %d).", data2.status) return false, string.format("HTTP 404 status changed for second request (became %d).", data2.status)
@@ -2163,8 +2165,8 @@ function identify_404(host, port)
-- Check if the return code became something other than 200 -- Check if the return code became something other than 200
if(data3.status ~= 200) then if(data3.status ~= 200) then
if(data3.status == nil) then if(type(data3.status) ~= "number") then
data3.status = "<unknown>" data3.status = -1
end end
stdnse.print_debug(1, "HTTP: HTTP 404 status changed for third request (became %d).", data3.status) stdnse.print_debug(1, "HTTP: HTTP 404 status changed for third request (became %d).", data3.status)
return false, string.format("HTTP 404 status changed for third request (became %d).", data3.status) return false, string.format("HTTP 404 status changed for third request (became %d).", data3.status)