PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-01-25 07:39:02 +00:00
Code Issues Projects Releases Wiki Activity

Adds support for user-selectable HTTP method. Closes #759

Browse Source
This commit is contained in:
nnposter
2017-03-22 00:28:01 +00:00
parent d80a4e4e59
commit 4bffd26c0b
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@@ -19,8 +19,8 @@ o [Ncat][GH#157] Ncat will now continue trying to connect to each resolved
o [NSE][GH#743] New script broadcast-ospf2-discover discovers OSPF 2 routers
and neighbors. OSPFv2 authentication is supported. [Emiliano Ticci]
o [NSE][GH#740] New script http-vuln-cve2017-5638 checks for the RCE bug in
Apache Struts. [Seth Jackson]
o [NSE][GH#740][GH#759] New script http-vuln-cve2017-5638 checks for the RCE
bug in Apache Struts2. [Seth Jackson]
o [NSE] Added several commands to redis-info to extract listening addresses,
connected clients, active channels, and cluster nodes. [Vasiliy Kulikov]

4
scripts/http-vuln-cve2017-5638.nse
View File

@@ -28,6 +28,7 @@ local string = require "string"
-- | https://cwiki.apache.org/confluence/display/WW/S2-045
-- |_ http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
--
-- @args http-vuln-cve2017-5638.method The HTTP method for the request. The default method is "GET".
-- @args http-vuln-cve2017-5638.path The URL path to request. The default path is "/".
author = "Seth Jackson"
@@ -58,6 +59,7 @@ vulnerability via the Content-Type header.
local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
local method = stdnse.get_script_args(SCRIPT_NAME..".method") or "GET"
local path = stdnse.get_script_args(SCRIPT_NAME..".path") or "/"
local value = stdnse.generate_random_string(8)
@@ -65,7 +67,7 @@ vulnerability via the Content-Type header.
["Content-Type"] = string.format("%%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Check-Struts', '%s')}.multipart/form-data", value)
}
local response = http.post(host, port, path, { header = header })
local response = http.generic_request(host, port, method, path, { header = header })
if response and response.status == 200 and response.header["x-check-struts"] == value then
vuln.state = vulns.STATE.VULN