PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-01-03 05:09:14 +00:00
Code Issues Projects Releases Wiki Activity

Don't use empty parentheses when referring to functions by name in NSE

Browse Source 
documentation.
This commit is contained in:
david
2008-11-07 22:49:49 +00:00
parent c272ad25b7
commit 5f166e19ec
24 changed files with 125 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scripts/asn-query.nse
View File

@@ -237,7 +237,7 @@ end
-- Extracts fields from the supplied DNS answer sections and generates a records entry for each.
-- @param answers Table containing string DNS answers.
-- @param asn_type String denoting whether the query is for Origin or Peer ASN.
-- @param recs Table of existing recognised answers to which to add (refer to the <code>records</code> table inside <code>action()</code>.
-- @param recs Table of existing recognised answers to which to add (refer to the <code>records</code> table inside <code>action</code>.
-- @return Boolean true if successful otherwise false.
function result_recog( answers, asn_type, recs, discoverer_ip )
@@ -428,7 +428,7 @@ end
---
-- Decides what to output based on the content of the supplied parameters and formats it for return by <code>action()</code>.
-- Decides what to output based on the content of the supplied parameters and formats it for return by <code>action</code>.
-- @param output String non-answer message to be returned as is or an empty table.
-- @param combined_records Table containing combined records.
-- @return Formatted nice output string.

2
scripts/http-open-proxy.nse
View File

@@ -22,7 +22,7 @@ categories = {"default", "discovery", "external", "intrusive"}
require "comm"
require "shortport"
--- An explode() function for NSE/LUA. Taken (and fixed) from http://lua-users.org/wiki/LuaRecipes
--- An explode function for NSE/LUA. Taken (and fixed) from http://lua-users.org/wiki/LuaRecipes
--@param d Delimiter
--@param p Buffer to explode
--@return A LUA Table

14
scripts/smb-enum-domains.nse
View File

@@ -1,13 +1,13 @@
description = [[
Attempts to enumerate domains on a system, along with their policies. This will likely only work without credentials against Windows 2000.
After the initial <code>bind()</code> to SAMR, the sequence of calls is:
* <code>Connect4()</code>: get a connect_handle
* <code>EnumDomains()</code>: get a list of the domains (stop here if you just want the names).
* <code>QueryDomain()</code>: get the SID for the domain.
* <code>OpenDomain()</code>: get a handle for each domain.
* <code>QueryDomainInfo2()</code>: get the domain information.
* <code>QueryDomainUsers()</code>: get a list of the users in the domain.
After the initial <code>bind</code> to SAMR, the sequence of calls is:
* <code>Connect4</code>: get a connect_handle
* <code>EnumDomains</code>: get a list of the domains (stop here if you just want the names).
* <code>QueryDomain</code>: get the SID for the domain.
* <code>OpenDomain</code>: get a handle for each domain.
* <code>QueryDomainInfo2</code>: get the domain information.
* <code>QueryDomainUsers</code>: get a list of the users in the domain.
]]
---

4
scripts/smb-enum-sessions.nse
View File

@@ -4,11 +4,11 @@ services), or through a SMB share.
Enumerating the local and terminal services users is done by reading the remote registry. Keys under
<code>HKEY_USERS</code> are SIDs that represent the currently logged in users, and those SIDs can be converted
to proper names by using the <code>LsaLookupSids()</code> function. Doing this requires any access higher than
to proper names by using the <code>LsaLookupSids</code> function. Doing this requires any access higher than
anonymous. Guests, users, or administrators are all able to perform this request on the operating
systems I (Ron Bowes) tested.
Enumerating SMB connections is done using the <code>srvsvc.netsessenum()</code> function, which returns who's
Enumerating SMB connections is done using the <code>srvsvc.netsessenum</code> function, which returns who's
logged in, when they logged in, and how long they've been idle for. Unfortunately, I couldn't find
a way to get the user's domain with this function, so the domain isn't printed. The level of access
required for this varies between Windows versions, but in Windows 2000 anybody (including the

14
scripts/smb-enum-shares.nse
View File

@@ -1,21 +1,21 @@
description = [[
Attempts to list shares using the <code>srvsvc.NetShareEnumAll()</code> MSRPC function, then
retrieve more information about each share using <code>srvsvc.NetShareGetInfo()</code>.
Attempts to list shares using the <code>srvsvc.NetShareEnumAll</code> MSRPC function, then
retrieve more information about each share using <code>srvsvc.NetShareGetInfo</code>.
Running
<code>NetShareEnumAll()</code> will work anonymously on Windows 2000, and requires a user-level
account on any other Windows version. Calling <code>NetShareGetInfo()</code> requires an
<code>NetShareEnumAll</code> will work anonymously on Windows 2000, and requires a user-level
account on any other Windows version. Calling <code>NetShareGetInfo</code> requires an
administrator account on every version of Windows I (Ron Bowes) tested.
Although <code>NetShareEnumAll()</code> is restricted on certain systems, actually connecting to
a share to check if it exists will always work. So, if <code>NetShareEnumAll()</code> fails, a
Although <code>NetShareEnumAll</code> is restricted on certain systems, actually connecting to
a share to check if it exists will always work. So, if <code>NetShareEnumAll</code> fails, a
list of common shares will be attempted.
After a list of shares is found, whether or not it's complete, we attempt to connect
to each of them anonymously, which lets us divide them into the classes
"anonymous" and "restricted."
When possible, once the list of shares is determined, <code>NetShareGetInfo()</code> is called
When possible, once the list of shares is determined, <code>NetShareGetInfo</code> is called
to get additional information on the share. Odds are this will fail, unless we're
doing an authenticated test.
]]

18
scripts/smb-enum-users.nse
View File

@@ -4,20 +4,20 @@ information as possible, through a variety of techniques (over SMB and MSRPC,
which uses port 445 or 139). Some functions in SAMR are used to enumerate
users, and some brute-force guessing using LSA functions is attempted.
One technique used is calling the <code>QueryDisplayInfo()</code> function in the SAMR library.
One technique used is calling the <code>QueryDisplayInfo</code> function in the SAMR library.
If this succeeds, it will return a detailed list of users. This can be done
anonymously against Windows 2000, and with a user-level account on other Windows
versions (but not with a guest-level account).
To perform this test, the following functions are used:
* <code>Bind()</code>: bind to the SAMR service.
* <code>Connect4()</code>: get a connect_handle.
* <code>EnumDomains()</code>: get a list of the domains.
* <code>QueryDomain()</code>: get the sid for the domain.
* <code>OpenDomain()</code>: get a handle for each domain.
* <code>QueryDisplayInfo()</code>: get the list of users in the domain.
* <code>Close()</code>: Close the domain handle.
* <code>Close()</code>: Close the connect handle.
* <code>Bind</code>: bind to the SAMR service.
* <code>Connect4</code>: get a connect_handle.
* <code>EnumDomains</code>: get a list of the domains.
* <code>QueryDomain</code>: get the sid for the domain.
* <code>OpenDomain</code>: get a handle for each domain.
* <code>QueryDisplayInfo</code>: get the list of users in the domain.
* <code>Close</code>: Close the domain handle.
* <code>Close</code>: Close the connect handle.
The advantage of this technique is that a lot of details are returned, including
the full name and description; the disadvantage is that it requires a user-level
account on every system except for Windows 2000. Additionally, it only pulls actual

24
scripts/whois.nse
View File

@@ -124,7 +124,7 @@ action = function( host )
--@field whoisdb_default_order The default number and order of whois services to query.
--@field using_local_assignments_file Set this to: false; to avoid using the data from IANA hosted assignments files (false when whodb=nofile).
--@field local_assignments_file_expiry A period, between 0 and 7 days, during which cached assignments data may be used without being refreshed.
--@field init_done Set when script_init() has been called and prevents it being called again.
--@field init_done Set when <code>script_init</code> has been called and prevents it being called again.
--@field mutex A table of mutex functions, one for each service defined herein. Allows a thread exclusive access to a
-- service, preventing concurrent connections to it.
--@field nofollow A flag that prevents referrals to other whois records and allows the first record retrieved to be
@@ -159,12 +159,12 @@ action = function( host )
-- @class table
--@field data.iana is set after the table is initialised and is the number of times a response encountered represents "The Whole Address Space".
-- If the value reaches 2 it is assumed that a valid record is held at ARIN.
--@field data.id is set in analyse_response() after final record and is the service name at which a valid record has been found. Used in
-- format_data_for_output().
--@field data.mirror is set in analyse_response() after final record and is the service name from which a mirrored record has been found. Used in
-- format_data_for_output().
--@field data.comparison is set in analyse_response() after final record and is a string concatenated from fields extracted from a record and which
-- serves as a fingerprint for a record, used in get_cache_key(), to compare two records for equality.
--@field data.id is set in <code>analyse_response</code> after final record and is the service name at which a valid record has been found. Used in
-- <code>format_data_for_output</code>.
--@field data.mirror is set in <code>analyse_response</code> after final record and is the service name from which a mirrored record has been found. Used in
-- <code>format_data_for_output</code>.
--@field data.comparison is set in <code>analyse_response</code> after final record and is a string concatenated from fields extracted from a record and which
-- serves as a fingerprint for a record, used in <code>get_cache_key</code>, to compare two records for equality.
local data = {}
data.iana = 0
@@ -1117,7 +1117,7 @@ end
---
-- When passed to table.sort(), will sort a table of tables containing IP address ranges in ascending order of size.
-- When passed to <code>table.sort</code>, will sort a table of tables containing IP address ranges in ascending order of size.
-- Identical ranges will be sorted in descending order of their position within a record if it is present.
-- @param range_1 Table: {range = String, pointer = Number}
-- where range is an IP address range and pointer is the position of that range in a record.
@@ -1177,7 +1177,7 @@ end
---
-- Controls what to output at the end of the script execution. Attempts to get data from the registry. If the data is a string it is output as
-- it is. If the data is a table then format_data_for_output() is called. If there is no cached data, nothing will be output.
-- it is. If the data is a table then <code>format_data_for_output</code> is called. If there is no cached data, nothing will be output.
-- @param ip String representing the Target's IP address.
-- @param services_queried Table of strings. Each is the id of a whois service queried for the Target (tracking.completed).
-- @return String - Host Script Results.
@@ -1825,7 +1825,7 @@ end
---
-- Uses fetchfile() to get the path of the parent directory of the supplied Nmap datafile filename.
-- Uses <code>nmap.fetchfile</code> to get the path of the parent directory of the supplied Nmap datafile filename.
-- @param fname String - Filename of an Nmap datafile.
-- @return String - The filepath of the directory containing the supplied filename including the trailing slash (or nil in case of an error).
-- @return Nil or error message in case of an error.
@@ -1961,7 +1961,7 @@ end
-- @param url String representing the full URL of the remote resource.
-- @param mod_date String representing an HTTP date.
-- @param e_tag String representing an HTTP entity tag.
-- @return Table as per http.request() or nil in case of a non-HTTP error.
-- @return Table as per <code>http.request</code> or <code>nil</code> in case of a non-HTTP error.
-- @return Nil or error message in case of an error.
-- @see http.request
@@ -2165,7 +2165,7 @@ end
--
-- Passed to table.sort(), will sort a table of IP assignments such that sub-assignments appear before their parent.
-- Passed to <code>table.sort</code>, will sort a table of IP assignments such that sub-assignments appear before their parent.
-- This function is not in use at the moment (see get_local_assignments_data) and will not appear in nse documentation.
-- @param first Table { range = { first = IP_addr, last = IP_addr } }
-- @param second Table { range = { first = IP_addr, last = IP_addr } }