PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-11 10:19:03 +00:00
Code Issues Projects Releases Wiki Activity

Removed the restriction in the portrule that would prevent this script from

Browse Source 
running against non-Apache (or non-Apache based) services.  Updated the comments
to reflect this change.
This commit is contained in:
jah
2009-08-17 22:50:19 +00:00
parent 537e938378
commit 4830a3ea29
1 changed files with 2 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
scripts/apache-userdir-enum.nse
View File

@@ -3,7 +3,7 @@ license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery"} categories = {"discovery"}
description = [[ description = [[
Attempts to enumerate valid usernames on webservers running with the mod_userdir Attempts to enumerate valid usernames on webservers running with the mod_userdir
module enabled. module or similar enabled.
The Apache mod_userdir module allows user-specific directories to be accessed The Apache mod_userdir module allows user-specific directories to be accessed
using the http://example.com/~user/ syntax. This script makes http requests in using the http://example.com/~user/ syntax. This script makes http requests in
@@ -36,9 +36,7 @@ local datafiles = require 'datafiles'
--- ---
-- The script will run against http[s] and http[s]-alt ports and, if version -- The script will run against http[s] and http[s]-alt tcp ports.
-- detection is performed, will run only against targets likely to be using
-- mod_userdir or similar.
portrule = function(host, port) portrule = function(host, port)
local svc = { std = { ["http"] = 1, ["http-alt"] = 1 }, local svc = { std = { ["http"] = 1, ["http-alt"] = 1 },
ssl = { ["https"] = 1, ["https-alt"] = 1 } } ssl = { ["https"] = 1, ["https-alt"] = 1 } }
@@ -51,22 +49,6 @@ portrule = function(host, port)
nmap.have_ssl() then nmap.have_ssl() then
return false return false
end end
-- Reduce execution to likely targets when version detection was performed
if port.version and port.version.product then
local v = port.version
if v.product:lower():match('apache') and
not ( v.product:lower():match('tomcat') or v.product:lower():match('coyote') ) then
return true
elseif v.product:lower():match('lighttpd') then
return true
elseif v.product:lower():match('nginx') then
return true -- unlikely! no userdir module for nginx, but config can emulate it.
elseif v.extrainfo and v.extrainfo:lower():match('based on apache') then
return true
else
return false
end
end
return true return true
end end