PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-07 13:11:28 +00:00
Code Issues Projects Releases Wiki Activity

Don't use empty parentheses when referring to functions by name in NSE

Browse Source 
documentation.
This commit is contained in:
david
2008-11-07 22:49:49 +00:00
parent c272ad25b7
commit 5f166e19ec
24 changed files with 125 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nselib/bin.luadoc
View File

@@ -61,7 +61,7 @@ function pack(format, ...)
-- stopped. This can be used as the <code>init</code> value for subsequent
-- calls. The following return values are the values according to the format
-- string. Numerical values in the format string are interpreted as repetitions
-- like in <code>pack()</code>, except if used with <code>A</code>,
-- like in <code>pack</code>, except if used with <code>A</code>,
-- <code>B</code>, or <code>H</code>, in which cases the number tells
-- <code>unpack</code> how many bytes to read. <code>unpack</code> stops if
-- either the format string or the binary data string are exhausted.

4
nselib/comm.lua
View File

@@ -2,7 +2,7 @@
-- banner grabbing and data exchange.
--
-- The functions in this module return values appropriate for use with
-- exception handling via <code>nmap.new_try()</code>.
-- exception handling via <code>nmap.new_try</code>.
--
-- These functions may be passed a table of options, but it's not required. The
-- keys for the options table are <code>"bytes"</code>, <code>"lines"</code>,
@@ -10,7 +10,7 @@
-- a minimum number of bytes to read. <code>"lines"</code> does the same for
-- lines. <code>"proto"</code> sets the protocol to communicate with,
-- defaulting to <code>"tcp"</code> if not provided. <code>"timeout"</code>
-- sets the socket timeout (see the socket function <code>set_timeout()</code>
-- sets the socket timeout (see the socket function <code>set_timeout</code>
-- for details).
--
-- If both <code>"bytes"</code> and <code>"lines"</code> are provided,

6
nselib/datafiles.lua
View File

@@ -2,7 +2,7 @@
-- <code>nmap-rpc</code>, and <code>nmap-services</code>.
--
-- The functions in this module return values appropriate for use with exception
-- handling via <code>nmap.new_try()</code>. On success, they return true and
-- handling via <code>nmap.new_try</code>. On success, they return true and
-- the function result. On failure, they return false and an error message.
-- @author Kris Katterjohn 03/2008
-- @author jah 08/2008
@@ -69,7 +69,7 @@ end
-- On success, return true and a table containing two subtables, indexed by the
-- keys "tcp" and "udp". The <code>tcp</code> subtable maps TCP port numbers to
-- service names, and the <code>udp</code> subtable is the same for UDP. You can
-- pass "tcp" or "udp" as an argument to <code>parse_services()</code> to get
-- pass "tcp" or "udp" as an argument to <code>parse_services</code> to get
-- only one of the results tables.
-- @param protocol The protocol table to return (<code>"tcp"</code> or
-- <code>"udp"</code>).
@@ -157,7 +157,7 @@ end
-- @param lines An array of strings to operate on.
-- @param data_struct A table containing capture patterns to be applied
-- to each string in the array. A capture will be applied to each string
-- using <code>string.match()</code> and may also be enclosed within a table or
-- using <code>string.match</code> and may also be enclosed within a table or
-- a function. If a function, it must accept a string as its parameter and
-- should return one value derived from that string.
-- @return A table whose structure mirrors that of the capture table,

2
nselib/dns.lua
View File

@@ -462,7 +462,7 @@ end
--
-- Caution: doesn't encode answer, authority and additional part.
-- @param pkt Table representing DNS packet, initialized by
-- <code>newPacket()</code>.
-- <code>newPacket</code>.
-- @return Encoded DNS packet.
function encode(pkt)
if type(pkt) ~= "table" then return nil end

6
nselib/http.lua
View File

@@ -42,11 +42,11 @@ local stdnse = require 'stdnse'
-- the port number or a table like the port table passed to a portrule or
-- hostrule. The third argument is the path of the resource. The fourth argument
-- is a table for further options. The function builds the request and calls
-- <code>http.request()</code>.
-- <code>http.request</code>.
-- @param host The host to query.
-- @param port The port for the host.
-- @param path The path of the resource.
-- @param options A table of options, as with <code>http.request()</code>.
-- @param options A table of options, as with <code>http.request</code>.
-- @return Table as described in the function description.
-- @see http.request
get = function( host, port, path, options )
@@ -74,7 +74,7 @@ end
--
-- The second argument is a table for further options.
-- @param u The URL of the host.
-- @param options A table of options, as with <code>http.request()</code>.
-- @param options A table of options, as with <code>http.request</code>.
-- @see http.get
get_url = function( u, options )
local parsed = url.parse( u )

2
nselib/ipOps.lua
View File

@@ -507,7 +507,7 @@ end
-- binary digits.
--
-- Each hex digit results in four bits. This function is really just a wrapper
-- around <code>stdnse.tobinary()</code>.
-- around <code>stdnse.tobinary</code>.
-- @param hex String representing a hexadecimal number.
-- @usage
-- bin_string = ipOps.hex_to_bin( "F00D" )

2
nselib/listop.lua
View File

@@ -4,7 +4,7 @@
-- or Haskell, appreciate their handling of lists very much. The
-- <code>listop</code> module tries to bring much of the functionality from
-- functional languages to Lua using Lua's central data structure, the table, as
-- a base for its list operations. Highlights include a <code>map()</code>
-- a base for its list operations. Highlights include a <code>map</code>
-- function applying a given function to each element of a list.
-- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html

2
nselib/match.lua
View File

@@ -1,7 +1,7 @@
--- Buffered network I/O helper functions.
--
-- The functions in this module can be used for delimiting data received by the
-- <code>nmap.receive_buf()</code> function in the Network I/O API (which see).
-- <code>nmap.receive_buf</code> function in the Network I/O API (which see).
-- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html
module(... or "match", package.seeall)

94
nselib/msrpc.lua
View File

@@ -8,9 +8,9 @@
--
-- To make use of these function calls, a SMB session with the server has to be
-- established. This can be done manually with the <code>smb</code> library, or the function
-- <code>start_smb()</code> can be called.
-- <code>start_smb</code> can be called.
--
-- Next, the interface has to be bound. The bind() function will take care of that.
-- Next, the interface has to be bound. The <code>bind</code> function will take care of that.
--
-- After that, you're free to call any function that's part of that interface. In
-- other words, if you bind to the SAMR interface, you can only call the samr_
@@ -110,15 +110,15 @@ local function string_to_unicode(string, do_null, do_align)
return result
end
--- Read a unicode string from a buffer, similar to how <code>bin.unpack()</code> would, optionally eat the null terminator,
--- Read a unicode string from a buffer, similar to how <code>bin.unpack</code> would, optionally eat the null terminator,
-- and optionally align it to 4-byte boundaries.
--
--@param buffer The buffer to read from, typically the full 'arguments' value for MSRPC
--@param pos The position in the buffer to start (just like <code>bin.unpack()</code>)
--@param pos The position in the buffer to start (just like <code>bin.unpack</code>)
--@param length The number of ascii characters that will be read (including the null, if do_null is set).
--@param do_null [optional] Remove a null terminator from the string as the last character. Default false.
--@param do_align [optional] Ensure that the number of bytes removed is a multiple of 4.
--@return (pos, string) The new position and the string read, again imitating <code>bin.unpack()</code>. If there was an
--@return (pos, string) The new position and the string read, again imitating <code>bin.unpack</code>. If there was an
-- attempt to read off the end of the string, then 'nil' is returned for both parameters.
local function unicode_to_string(buffer, pos, length, do_null, do_align)
local i, ch, dummy
@@ -237,7 +237,7 @@ end
--- This is a wrapper around the SMB class, designed to get SMB going quickly for MSRPC calls. This will
-- connect to the SMB server, negotiate the protocol, open a session, connect to the IPC$ share, and
-- open the named pipe given by 'path'. When this successfully returns, the 'smbstate' table can be immediately
-- used for MSRPC (the <code>bind()</code> function should be called right after).
-- used for MSRPC (the <code>bind</code> function should be called right after).
--
-- Note that the smbstate table is the same one used in the SMB files (obviously), so it will contain
-- the various responses/information places in there by SMB functions.
@@ -288,7 +288,7 @@ function start_smb(host, path)
return true, smbstate
end
--- A wrapper around the <code>smb.stop()</code> function. I only created it to add symmetry, so client code
--- A wrapper around the <code>smb.stop</code> function. I only created it to add symmetry, so client code
-- doesn't have to call both msrpc and smb functions.
--
--@param state The SMB state table.
@@ -392,7 +392,7 @@ function bind(smbstate, interface_uuid, interface_version, transfer_syntax)
return false, "MSRPC call returned an incorrect 'call_id' value"
end
-- If we made it this far, then we have a valid Bind() response. Pull out some more parameters.
-- If we made it this far, then we have a valid <code>Bind</code> response. Pull out some more parameters.
pos, response['max_transmit_frag'], response['max_receive_frag'], response['assoc_group'], response['secondary_address_length'] = bin.unpack("SSIS", data, pos)
-- Read the secondary address
@@ -424,7 +424,7 @@ end
--
-- There's a reason that SMB is sometimes considered to be between layer 4 and 7 on the OSI model. :)
--
--@param smbstate The SMB state table (after <code>bind()</code> has been called).
--@param smbstate The SMB state table (after <code>bind</code> has been called).
--@param opnum The operating number (ie, the function). Find this in the MSRPC documentation or with a packet logger.
--@param arguments The marshalled arguments to pass to the function. Currently, marshalling is all done manually.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
@@ -497,7 +497,7 @@ local function call_function(smbstate, opnum, arguments)
end
---Call the MSRPC function <code>netshareenumall()</code> on the remote system. This function basically returns a list of all the shares
---Call the MSRPC function <code>netshareenumall</code> on the remote system. This function basically returns a list of all the shares
-- on the system.
--
--@param smbstate The SMB state table
@@ -606,7 +606,7 @@ function srvsvc_netshareenumall(smbstate, server)
return true, response
end
---Call the MSRPC function <code>netsharegetinfo()</code> on the remote system. This function retrieves extra information about a share
---Call the MSRPC function <code>netsharegetinfo</code> on the remote system. This function retrieves extra information about a share
-- on the system.
--
--@param smbstate The SMB state table
@@ -784,7 +784,7 @@ end
---Call the <code>NetSessEnum()</code> function, which gets a list of active sessions on the host. For this function,
---Call the <code>NetSessEnum</code> function, which gets a list of active sessions on the host. For this function,
-- a session is defined as a connection to a file share.
--
--@param smbstate The SMB state table
@@ -910,7 +910,7 @@ function srvsvc_netsessenum(smbstate, server)
return true, response
end
--- Calls the <code>NetServerGetStatistics()</code> function, which grabs a bunch of statistics on the server.
--- Calls the <code>NetServerGetStatistics</code> function, which grabs a bunch of statistics on the server.
-- This function requires administrator access to call.
--
-- Note: Wireshark 1.0.3 doesn't parse this packet properly.
@@ -1016,7 +1016,7 @@ function srvsvc_netservergetstatistics(smbstate, server)
end
---Call the <code>connect4()</code> function, to obtain a "connect handle". This must be done before calling many
---Call the <code>connect4</code> function, to obtain a "connect handle". This must be done before calling many
-- of the SAMR functions.
--
--@param smbstate The SMB state table
@@ -1078,10 +1078,10 @@ function samr_connect4(smbstate, server)
return true, response
end
---Call the <code>enumdomains()</code> function, which returns a list of all domains in use by the system.
---Call the <code>enumdomains</code> function, which returns a list of all domains in use by the system.
--
--@param smbstate The SMB state table
--@param connect_handle The connect_handle, returned by samr_connect4()
--@param smbstate The SMB state table.
--@param connect_handle The connect_handle, returned by <code>samr_connect4</code>.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful one being 'domains', which is a list of the domains.
function samr_enumdomains(smbstate, connect_handle)
@@ -1157,12 +1157,12 @@ function samr_enumdomains(smbstate, connect_handle)
return true, response
end
---Call the <code>LookupDomain()</code> function, which converts a domain's name into its sid, which is
---Call the <code>LookupDomain</code> function, which converts a domain's name into its sid, which is
-- required to do operations on the domain.
--
--@param smbstate The SMB state table
--@param connect_handle The connect_handle, returned by <code>samr_connect4()</code>
--@param domain The name of the domain (all domain names can be obtained with <code>samr_enumdomains()</code>)
--@param connect_handle The connect_handle, returned by <code>samr_connect4</code>
--@param domain The name of the domain (all domain names can be obtained with <code>samr_enumdomains</code>)
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful one being 'sid', which is required to call other functions.
function samr_lookupdomain(smbstate, connect_handle, domain)
@@ -1226,12 +1226,12 @@ function samr_lookupdomain(smbstate, connect_handle, domain)
return true, response
end
---Call <code>OpenDomain()</code>, which returns a handle to the domain identified by the given sid.
---Call <code>OpenDomain</code>, which returns a handle to the domain identified by the given sid.
-- This is required before calling certain functions.
--
--@param smbstate The SMB state table
--@param connect_handle The connect_handle, returned by <code>samr_connect4()</code>
--@param sid The sid for the domain, returned by <code>samr_lookupdomain()</code>
--@param connect_handle The connect_handle, returned by <code>samr_connect4</code>
--@param sid The sid for the domain, returned by <code>samr_lookupdomain</code>
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful one being 'domain_handle', which is used to call other functions.
function samr_opendomain(smbstate, connect_handle, sid)
@@ -1287,11 +1287,11 @@ function samr_opendomain(smbstate, connect_handle, sid)
return true, response
end
---Call <code>EnumDomainUsers()</code>, which returns a list of users only. To get more information about the users, the
-- QueryDisplayInfo() function can be used.
---Call <code>EnumDomainUsers</code>, which returns a list of users only. To get more information about the users, the
-- <code>QueryDisplayInfo</code> function can be used.
--
--@param smbstate The SMB state table
--@param domain_handle The domain_handle, returned by <code>samr_opendomain()</code>
--@param domain_handle The domain_handle, returned by <code>samr_opendomain</code>
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful one being 'names', which is a list of usernames in that domain.
function samr_enumdomainusers(smbstate, domain_handle)
@@ -1370,7 +1370,7 @@ function samr_enumdomainusers(smbstate, domain_handle)
end
---Call <code>QueryDisplayInfo()</code>, which returns a list of users with accounts on the system, as well as extra information about
---Call <code>QueryDisplayInfo</code>, which returns a list of users with accounts on the system, as well as extra information about
-- them (their full name and description).
--
-- I found in testing that trying to get all the users at once is a mistake, it returns ERR_BUFFER_OVERFLOW, so instead I'm
@@ -1378,7 +1378,7 @@ end
-- number of users on the system.
--
--@param smbstate The SMB state table
--@param domain_handle The domain handle, returned by <code>samr_opendomain()</code>
--@param domain_handle The domain handle, returned by <code>samr_opendomain</code>
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful ones being 'names', a list of all the usernames, and 'details', a further list of tables with the elements
-- 'name', 'fullname', and 'description' (note that any of them can be nil if the server didn't return a value). Finally,
@@ -1528,10 +1528,10 @@ function samr_querydisplayinfo(smbstate, domain_handle)
return true, response
end
---Call <code>QueryDomainInfo2()</code>, which grabs various data about a domain.
---Call <code>QueryDomainInfo2</code>, which grabs various data about a domain.
--
--@param smbstate The SMB state table
--@param domain_handle The domain_handle, returned by <code>samr_opendomain()</code>
--@param domain_handle The domain_handle, returned by <code>samr_opendomain</code>
--@param level The level, which determines which type of information to query for. See the @return section
-- for details.
--@param response [optional] A 'result' to add the entries to. This lets us call this function multiple times,
@@ -1647,7 +1647,7 @@ function samr_querydomaininfo2(smbstate, domain_handle, level, response)
return true, response
end
---Call the <code>close()</code> function, which closes a handle of any type (for example, domain_handle or connect_handle)
---Call the <code>close</code> function, which closes a handle of any type (for example, domain_handle or connect_handle)
--@param smbstate The SMB state table
--@param handle The handle to close
--@return (status, result) If status is false, result is an error message. Otherwise, result is potentially
@@ -1690,7 +1690,7 @@ function samr_close(smbstate, handle)
return true, response
end
---Call the <code>LsarOpenPolicy2()</code> function, to obtain a "policy handle". This must be done before calling many
---Call the <code>LsarOpenPolicy2</code> function, to obtain a "policy handle". This must be done before calling many
-- of the LSA functions.
--
--@param smbstate The SMB state table
@@ -1762,10 +1762,10 @@ function lsa_openpolicy2(smbstate, server)
return true, response
end
---Call the <code>LsarLookupNames2()</code> function, to convert the server's name into a sid.
---Call the <code>LsarLookupNames2</code> function, to convert the server's name into a sid.
--
--@param smbstate The SMB state table
--@param policy_handle The policy handle returned by <code>lsa_openpolicy2()</code>
--@param policy_handle The policy handle returned by <code>lsa_openpolicy2</code>
--@param names An array of names to look up. To get a SID, only one of the names needs to be valid.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values.
-- The most useful result is 'domains', which is a list of domains known to the server. And, for each of the
@@ -1936,14 +1936,14 @@ function lsa_lookupnames2(smbstate, policy_handle, names)
return true, response
end
---Call the <code>LsarLookupSids2()</code> function, to convert a list of SIDs to their names
---Call the <code>LsarLookupSids2</code> function, to convert a list of SIDs to their names
--
--@param smbstate The SMB state table
--@param policy_handle The policy handle returned by <code>lsa_openpolicy2()</code>
--@param policy_handle The policy handle returned by <code>lsa_openpolicy2</code>
--@param sid The SID object for the server
--@param rids The RIDs of users to look up
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values.
-- The element 'domains' is identical to the lookupnames2() element called 'domains'. The element 'names' is a
-- The element 'domains' is identical to the <code>lookupnames2</code> element called 'domains'. The element 'names' is a
-- list of strings, for the usernames (not necessary a 1:1 mapping with the RIDs), and the element 'details' is
-- a table containing more information about each name, even if the name wasn't found (this one is a 1:1 mapping
-- with the RIDs).
@@ -2126,7 +2126,7 @@ function lsa_lookupsids2(smbstate, policy_handle, sid, rids)
end
---Call the <code>close()</code> function, which closes a session created with a <code>lsa_openpolicy()</code>-style function
---Call the <code>close</code> function, which closes a session created with a <code>lsa_openpolicy</code>-style function
--@param smbstate The SMB state table
--@param handle The handle to close
--@return (status, result) If status is false, result is an error message. Otherwise, result is potentially
@@ -2169,7 +2169,7 @@ function lsa_close(smbstate, handle)
return true, response
end
---Call the <code>OpenHKU()</code> function, to obtain a handle to the HKEY_USERS hive
---Call the <code>OpenHKU</code> function, to obtain a handle to the HKEY_USERS hive
--
--@param smbstate The SMB state table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
@@ -2216,7 +2216,7 @@ function winreg_openhku(smbstate)
end
---Call the <code>OpenHKLM()</code> function, to obtain a handle to the HKEY_LOCAL_MACHINE hive
---Call the <code>OpenHKLM</code> function, to obtain a handle to the HKEY_LOCAL_MACHINE hive
--
--@param smbstate The SMB state table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
@@ -2263,11 +2263,11 @@ function winreg_openhklm(smbstate)
end
---Calls the Windows registry function <code>EnumKey()</code>, which returns a single key
---Calls the Windows registry function <code>EnumKey</code>, which returns a single key
-- under the given handle, at the index of 'index'.
--
--@param smbstate The SMB state table
--@param handle A handle to hive or key. <code>winreg_openhku()</code> provides a useable key, for example.
--@param handle A handle to hive or key. <code>winreg_openhku</code> provides a useable key, for example.
--@param index The index of the key to return. Generally you'll start at 0 and increment until
-- an error is returned.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
@@ -2373,10 +2373,10 @@ function winreg_enumkey(smbstate, handle, index)
end
--- Calls the function <code>OpenKey()</code>, which obtains a handle to a named key.
--- Calls the function <code>OpenKey</code>, which obtains a handle to a named key.
--
--@param smbstate The SMB state table
--@param handle A handle to hive or key. <code>winreg_openhku()</code> provides a useable key, for example.
--@param handle A handle to hive or key. <code>winreg_openhku</code> provides a useable key, for example.
--@param keyname The name of the key to open.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
-- useful one being 'handle', which is a handle to the newly opened key.
@@ -2442,7 +2442,7 @@ function winreg_openkey(smbstate, handle, keyname)
return true, response
end
--- Calls the function <code>QueryInfoKey()</code>, which obtains information about an opened key.
--- Calls the function <code>QueryInfoKey</code>, which obtains information about an opened key.
--
--@param smbstate The SMB state table
--@param handle A handle to the key that's being queried.
@@ -2537,7 +2537,7 @@ function winreg_queryinfokey(smbstate, handle)
end
--- Calls the function <code>QueryValue()</code>, which returns the value of the requested key.
--- Calls the function <code>QueryValue</code>, which returns the value of the requested key.
--
--@param smbstate The SMB state table
--@param handle A handle to the key that's being queried.
@@ -2648,7 +2648,7 @@ end
--- Calls the function <code>CloseKey()</code>, which closes an opened handle. Strictly speaking, this doesn't have to be called (Windows
--- Calls the function <code>CloseKey</code>, which closes an opened handle. Strictly speaking, this doesn't have to be called (Windows
-- will close the key for you), but it's good manners to clean up after yourself.
--
--@param smbstate The SMB state table

4
nselib/netbios.lua
View File

@@ -143,7 +143,7 @@ end
--- Sends out a UDP probe on port 137 to get the server's name (that is, the
-- entry in its NBSTAT table with a 0x20 suffix).
--@param host The IP or hostname of the server.
--@param names [optional] The names to use, from do_nbstat().
--@param names [optional] The names to use, from <code>do_nbstat</code>.
--@return (status, result) If status is true, the result is the NetBIOS name.
-- otherwise, result is an error message.
function get_server_name(host, names)
@@ -173,7 +173,7 @@ end
-- the server's name. If the username can't be determined, which is frequently
-- the case, nil is returned.
--@param host The IP or hostname of the server.
--@param names [optional] The names to use, from do_nbstat().
--@param names [optional] The names to use, from <code>do_nbstat</code>.
--@return (status, result) If status is true, the result is the NetBIOS name or nil.
-- otherwise, result is an error message.
function get_user_name(host, names)

10
nselib/nmap.luadoc
View File

@@ -215,7 +215,7 @@ function new_socket()
-- <code>"tcp"</code> if not specified.
--
-- On success the function returns true. On failure it returns false and an
-- error string. Those strings are taken from the <code>gai_strerror()</code> C
-- error string. Those strings are taken from the <code>gai_strerror</code> C
-- function. They are (with the error code in parentheses):
-- * <code>"Address family for hostname not supported"</code> (<code>EAI_ADDRFAMILY</code>)
-- * <code>"Temporary failure in name resolution"</code> (<code>EAI_AGAIN</code>)
@@ -377,7 +377,7 @@ function close()
-- values. If an error occurred, the first value is <code>nil</code> and the
-- second value is an error string. Otherwise the first value is true and the
-- remaining 4 values describe both endpoints of the TCP connection. If you put
-- the call inside an exception handler created by <code>new_try()</code> the
-- the call inside an exception handler created by <code>new_try</code> the
-- status value is consumed. The call can be used for example if you want to
-- query an authentication server.
-- @return Status (true or false).
@@ -426,9 +426,9 @@ function pcap_open(device, snaplen, promisc, test_function, bpf)
--
-- The provided <code>packet_hash</code> is a binary string which has to match
-- the hash returned by the <code>test_function</code> parameter provided to
-- <code>pcap_open()</code>. If you want to receive all packets, just provide
-- <code>pcap_open</code>. If you want to receive all packets, just provide
-- the empty string (<code>""</code>). There has to be a call to
-- <code>pcap_register()</code> before a call to <code>pcap_receive()</code>.
-- <code>pcap_register</code> before a call to <code>pcap_receive</code>.
-- @param packet_hash A binary string that is compared against packet hashes.
-- @see pcap_open, pcap_receive
-- @usage socket:pcap_register("")
@@ -471,7 +471,7 @@ function ethernet_open(interface_name)
--
-- The dnet object must be associated with a previously opened interface. The
-- packet must include the IP and ethernet headers. If there was no previous
-- valid call to <code>ethernet_open()</code> an error is thrown
-- valid call to <code>ethernet_open</code> an error is thrown
-- (<code>"dnet is not valid opened ethernet interface"</code>).
-- @param packet An ethernet frame to send.
-- @see new_dnet

6
nselib/pcre.luadoc
View File

@@ -91,7 +91,7 @@ function match(string, start, flags)
--- Matches a string against a compiled regular expression, returning positions
-- of substring matches.
--
-- This function is like <code>match()</code> except that a table returned as a
-- This function is like <code>match</code> except that a table returned as a
-- third result contains offsets of substring matches rather than substring
-- matches themselves. That table will not contain string keys, even if named
-- sub-patterns are used. For example, if the whole match is at offsets 10, 20
@@ -120,8 +120,8 @@ function exec(string, start, flags)
-- the positions where the corresponding sub-pattern did not match. If named
-- sub-patterns are used then the table also contains substring matches keyed
-- by their correspondent sub-pattern names (strings). If <code>func</code>
-- returns a true value, then <code>gmatch()</code> immediately returns;
-- <code>gmatch()</code> returns the number of matches made.
-- returns a true value, then <code>gmatch</code> immediately returns;
-- <code>gmatch</code> returns the number of matches made.
-- @param string the string to match against.
-- @param func the function to call for each match.
-- @param n the maximum number of matches to do (optional).

16
nselib/smb.lua
View File

@@ -36,7 +36,7 @@
-- status, err = smb.stop(smbstate)
--</code>
--
-- The <code>stop()</code> function will automatically call tree_disconnect and logoff,
-- The <code>stop</code> function will automatically call tree_disconnect and logoff,
-- cleaning up the session.
--
-- To initially begin the connection, there are two options:
@@ -64,7 +64,7 @@
-- If a username is set without a password, then a NULL session is started. If a login fails,
-- we attempt to log in as the 'GUEST' account with a blank password. If that fails, we try
-- setting up a NULL session. Starting a NULL session will always work, but we may not get
-- any further (tree_connect() might fail).
-- any further (<code>tree_connect</code> might fail).
--
-- In terms of the login protocol, by default, we sent only NTLMv1 authentication, Lanman
-- isn't set. The reason for this is, NTLMv2 isn't supported by every system (and I don't know
@@ -285,7 +285,7 @@ function start(host)
end
--- Kills the SMB connection, closes the socket, and releases the mutex. Because of the mutex
-- being released, a script HAS to call <code>stop()</code> before it exits, no matter why it's exiting!
-- being released, a script HAS to call <code>stop</code> before it exits, no matter why it's exiting!
--
-- In addition to killing the connection, this function will log off the user and disconnect
-- the connected tree, if possible.
@@ -574,7 +574,7 @@ function lm_create_response(lanman, challenge)
end
---Create the NTLM response to send back to the server. This is actually done the exact same way as the Lanman hash,
-- so I call the <code>Lanman()</code> function.
-- so I call the <code>Lanman</code> function.
--
--@param ntlm The NTLMv1 hash
--@param challenge The server's challenge.
@@ -612,7 +612,7 @@ function ntlmv2_create_hash(ntlm, username, domain)
return true, openssl.hmac("MD5", ntlm, unicode)
end
---Create the LMv2 response, which can be sent back to the server. This is identical to the <code>NTLMv2()</code> function,
---Create the LMv2 response, which can be sent back to the server. This is identical to the <code>NTLMv2</code> function,
-- except that it uses an 8-byte client challenge.
--
-- The reason for LMv2 is a long and twisted story. Well, not really. The reason is basically that the v1 hashes
@@ -722,7 +722,7 @@ end
-- The encoding is simple:
-- * (1 byte) The number of 2-byte values in the parameters section
-- * (variable) The parameter section
-- This is automatically done by <code>smb_send()</code>.
-- This is automatically done by <code>smb_send</code>.
--
-- @param parameters The parameters section.
-- @return The encoded parameters.
@@ -734,7 +734,7 @@ end
-- The encoding is simple:
-- * (2 bytes) The number of bytes in the data section
-- * (variable) The data section
-- This is automatically done by <code>smb_send()</code>.
-- This is automatically done by <code>smb_send</code>.
--
-- @param data The data section.
-- @return The encoded data.
@@ -747,7 +747,7 @@ end
-- wide, depending on whether or not we're using raw, but that shouldn't matter.
--
--@param smb The SMB object associated with the connection
--@param header The header, encoded with <code>smb_get_header()</code>.
--@param header The header, encoded with <code>smb_get_header</code>.
--@param parameters The parameters.
--@param data The data.
--@return (result, err) If result is false, err is the error message. Otherwise, err is

8
nselib/stdnse.lua
View File

@@ -21,10 +21,10 @@ module(... or "stdnse");
-- than or equal to a given level.
--
-- This is a convenience wrapper around
-- <code>nmap.print_debug_unformatted()</code>. The first optional numeric
-- <code>nmap.print_debug_unformatted</code>. The first optional numeric
-- argument, <code>verbosity</code>, is used as the verbosity level necessary
-- to print the message (it defaults to 1 if omitted). All remaining arguments
-- are processed with Lua's <code>string.format()</code> function.
-- are processed with Lua's <code>string.format</code> function.
-- @param level Optional verbosity level.
-- @param fmt Format string.
-- @param ... Arguments to format.
@@ -39,7 +39,7 @@ end
--- Join a list of strings with a separator string.
--
-- This is Lua's <code>table.concat()</code> function with the parameters
-- This is Lua's <code>table.concat</code> function with the parameters
-- swapped for coherence.
-- @usage
-- strjoin(", ", {"Anna", "Bob", "Charlie", "Dolores"})
@@ -90,7 +90,7 @@ end
-- @param socket Socket for the buffer.
-- @param sep Separator for the buffered reads.
-- @return Data from socket reads or <code>nil</code> on EOF or error.
-- @return Error message, as with <code>receive_lines()</code>.
-- @return Error message, as with <code>receive_lines</code>.
function make_buffer(socket, sep)
local point, left, buffer, done, msg = 1, "";
local function self()

2
nselib/strbuf.lua
View File

@@ -11,7 +11,7 @@
-- maintaining the nice syntax. This is accomplished by overloading the
-- concatenation operator (<code>..</code>), the equality operator (<code>==</code>) and the <code>tostring</code>
-- operator. A string buffer is created by passing a string to
-- <code>strbuf.new()</code>. Afterwards you can append to the string buffer,
-- <code>strbuf.new</code>. Afterwards you can append to the string buffer,
-- or compare two string buffers for equality just as you would do with normal
-- strings.
--

2
nselib/unpwdb.lua
View File

@@ -2,7 +2,7 @@
--
-- The <code>usernames</code> and <code>passwords</code> functions return
-- multiple values for use with exception handling via
-- <code>nmap.new_try()</code>. The first value is the Boolean success
-- <code>nmap.new_try</code>. The first value is the Boolean success
-- indicator, the second value is the closure.
--
-- The closures can take an argument of <code>"reset"</code> to rewind the list

2
nselib/url.lua
View File

@@ -8,7 +8,7 @@ LuaSocket toolkit.
Author: Diego Nehab
RCS ID: $Id: url.lua,v 1.37 2005/11/22 08:33:29 diego Exp $
parse_query() and build_query() added For nmap (Eddie Bell <ejlbell@gmail.com>)
parse_query and build_query added For nmap (Eddie Bell <ejlbell@gmail.com>)
--]]
-----------------------------------------------------------------------------

4
scripts/asn-query.nse
View File

@@ -237,7 +237,7 @@ end
-- Extracts fields from the supplied DNS answer sections and generates a records entry for each.
-- @param answers Table containing string DNS answers.
-- @param asn_type String denoting whether the query is for Origin or Peer ASN.
-- @param recs Table of existing recognised answers to which to add (refer to the <code>records</code> table inside <code>action()</code>.
-- @param recs Table of existing recognised answers to which to add (refer to the <code>records</code> table inside <code>action</code>.
-- @return Boolean true if successful otherwise false.
function result_recog( answers, asn_type, recs, discoverer_ip )
@@ -428,7 +428,7 @@ end
---
-- Decides what to output based on the content of the supplied parameters and formats it for return by <code>action()</code>.
-- Decides what to output based on the content of the supplied parameters and formats it for return by <code>action</code>.
-- @param output String non-answer message to be returned as is or an empty table.
-- @param combined_records Table containing combined records.
-- @return Formatted nice output string.

2
scripts/http-open-proxy.nse
View File

@@ -22,7 +22,7 @@ categories = {"default", "discovery", "external", "intrusive"}
require "comm"
require "shortport"
--- An explode() function for NSE/LUA. Taken (and fixed) from http://lua-users.org/wiki/LuaRecipes
--- An explode function for NSE/LUA. Taken (and fixed) from http://lua-users.org/wiki/LuaRecipes
--@param d Delimiter
--@param p Buffer to explode
--@return A LUA Table

14
scripts/smb-enum-domains.nse
View File

@@ -1,13 +1,13 @@
description = [[
Attempts to enumerate domains on a system, along with their policies. This will likely only work without credentials against Windows 2000.
After the initial <code>bind()</code> to SAMR, the sequence of calls is:
* <code>Connect4()</code>: get a connect_handle
* <code>EnumDomains()</code>: get a list of the domains (stop here if you just want the names).
* <code>QueryDomain()</code>: get the SID for the domain.
* <code>OpenDomain()</code>: get a handle for each domain.
* <code>QueryDomainInfo2()</code>: get the domain information.
* <code>QueryDomainUsers()</code>: get a list of the users in the domain.
After the initial <code>bind</code> to SAMR, the sequence of calls is:
* <code>Connect4</code>: get a connect_handle
* <code>EnumDomains</code>: get a list of the domains (stop here if you just want the names).
* <code>QueryDomain</code>: get the SID for the domain.
* <code>OpenDomain</code>: get a handle for each domain.
* <code>QueryDomainInfo2</code>: get the domain information.
* <code>QueryDomainUsers</code>: get a list of the users in the domain.
]]
---

4
scripts/smb-enum-sessions.nse
View File

@@ -4,11 +4,11 @@ services), or through a SMB share.
Enumerating the local and terminal services users is done by reading the remote registry. Keys under
<code>HKEY_USERS</code> are SIDs that represent the currently logged in users, and those SIDs can be converted
to proper names by using the <code>LsaLookupSids()</code> function. Doing this requires any access higher than
to proper names by using the <code>LsaLookupSids</code> function. Doing this requires any access higher than
anonymous. Guests, users, or administrators are all able to perform this request on the operating
systems I (Ron Bowes) tested.
Enumerating SMB connections is done using the <code>srvsvc.netsessenum()</code> function, which returns who's
Enumerating SMB connections is done using the <code>srvsvc.netsessenum</code> function, which returns who's
logged in, when they logged in, and how long they've been idle for. Unfortunately, I couldn't find
a way to get the user's domain with this function, so the domain isn't printed. The level of access
required for this varies between Windows versions, but in Windows 2000 anybody (including the

14
scripts/smb-enum-shares.nse
View File

@@ -1,21 +1,21 @@
description = [[
Attempts to list shares using the <code>srvsvc.NetShareEnumAll()</code> MSRPC function, then
retrieve more information about each share using <code>srvsvc.NetShareGetInfo()</code>.
Attempts to list shares using the <code>srvsvc.NetShareEnumAll</code> MSRPC function, then
retrieve more information about each share using <code>srvsvc.NetShareGetInfo</code>.
Running
<code>NetShareEnumAll()</code> will work anonymously on Windows 2000, and requires a user-level
account on any other Windows version. Calling <code>NetShareGetInfo()</code> requires an
<code>NetShareEnumAll</code> will work anonymously on Windows 2000, and requires a user-level
account on any other Windows version. Calling <code>NetShareGetInfo</code> requires an
administrator account on every version of Windows I (Ron Bowes) tested.
Although <code>NetShareEnumAll()</code> is restricted on certain systems, actually connecting to
a share to check if it exists will always work. So, if <code>NetShareEnumAll()</code> fails, a
Although <code>NetShareEnumAll</code> is restricted on certain systems, actually connecting to
a share to check if it exists will always work. So, if <code>NetShareEnumAll</code> fails, a
list of common shares will be attempted.
After a list of shares is found, whether or not it's complete, we attempt to connect
to each of them anonymously, which lets us divide them into the classes
"anonymous" and "restricted."
When possible, once the list of shares is determined, <code>NetShareGetInfo()</code> is called
When possible, once the list of shares is determined, <code>NetShareGetInfo</code> is called
to get additional information on the share. Odds are this will fail, unless we're
doing an authenticated test.
]]

18
scripts/smb-enum-users.nse
View File

@@ -4,20 +4,20 @@ information as possible, through a variety of techniques (over SMB and MSRPC,
which uses port 445 or 139). Some functions in SAMR are used to enumerate
users, and some brute-force guessing using LSA functions is attempted.
One technique used is calling the <code>QueryDisplayInfo()</code> function in the SAMR library.
One technique used is calling the <code>QueryDisplayInfo</code> function in the SAMR library.
If this succeeds, it will return a detailed list of users. This can be done
anonymously against Windows 2000, and with a user-level account on other Windows
versions (but not with a guest-level account).
To perform this test, the following functions are used:
* <code>Bind()</code>: bind to the SAMR service.
* <code>Connect4()</code>: get a connect_handle.
* <code>EnumDomains()</code>: get a list of the domains.
* <code>QueryDomain()</code>: get the sid for the domain.
* <code>OpenDomain()</code>: get a handle for each domain.
* <code>QueryDisplayInfo()</code>: get the list of users in the domain.
* <code>Close()</code>: Close the domain handle.
* <code>Close()</code>: Close the connect handle.
* <code>Bind</code>: bind to the SAMR service.
* <code>Connect4</code>: get a connect_handle.
* <code>EnumDomains</code>: get a list of the domains.
* <code>QueryDomain</code>: get the sid for the domain.
* <code>OpenDomain</code>: get a handle for each domain.
* <code>QueryDisplayInfo</code>: get the list of users in the domain.
* <code>Close</code>: Close the domain handle.
* <code>Close</code>: Close the connect handle.
The advantage of this technique is that a lot of details are returned, including
the full name and description; the disadvantage is that it requires a user-level
account on every system except for Windows 2000. Additionally, it only pulls actual

24
scripts/whois.nse
View File

@@ -124,7 +124,7 @@ action = function( host )
--@field whoisdb_default_order The default number and order of whois services to query.
--@field using_local_assignments_file Set this to: false; to avoid using the data from IANA hosted assignments files (false when whodb=nofile).
--@field local_assignments_file_expiry A period, between 0 and 7 days, during which cached assignments data may be used without being refreshed.
--@field init_done Set when script_init() has been called and prevents it being called again.
--@field init_done Set when <code>script_init</code> has been called and prevents it being called again.
--@field mutex A table of mutex functions, one for each service defined herein. Allows a thread exclusive access to a
-- service, preventing concurrent connections to it.
--@field nofollow A flag that prevents referrals to other whois records and allows the first record retrieved to be
@@ -159,12 +159,12 @@ action = function( host )
-- @class table
--@field data.iana is set after the table is initialised and is the number of times a response encountered represents "The Whole Address Space".
-- If the value reaches 2 it is assumed that a valid record is held at ARIN.
--@field data.id is set in analyse_response() after final record and is the service name at which a valid record has been found. Used in
-- format_data_for_output().
--@field data.mirror is set in analyse_response() after final record and is the service name from which a mirrored record has been found. Used in
-- format_data_for_output().
--@field data.comparison is set in analyse_response() after final record and is a string concatenated from fields extracted from a record and which
-- serves as a fingerprint for a record, used in get_cache_key(), to compare two records for equality.
--@field data.id is set in <code>analyse_response</code> after final record and is the service name at which a valid record has been found. Used in
-- <code>format_data_for_output</code>.
--@field data.mirror is set in <code>analyse_response</code> after final record and is the service name from which a mirrored record has been found. Used in
-- <code>format_data_for_output</code>.
--@field data.comparison is set in <code>analyse_response</code> after final record and is a string concatenated from fields extracted from a record and which
-- serves as a fingerprint for a record, used in <code>get_cache_key</code>, to compare two records for equality.
local data = {}
data.iana = 0
@@ -1117,7 +1117,7 @@ end
---
-- When passed to table.sort(), will sort a table of tables containing IP address ranges in ascending order of size.
-- When passed to <code>table.sort</code>, will sort a table of tables containing IP address ranges in ascending order of size.
-- Identical ranges will be sorted in descending order of their position within a record if it is present.
-- @param range_1 Table: {range = String, pointer = Number}
-- where range is an IP address range and pointer is the position of that range in a record.
@@ -1177,7 +1177,7 @@ end
---
-- Controls what to output at the end of the script execution. Attempts to get data from the registry. If the data is a string it is output as
-- it is. If the data is a table then format_data_for_output() is called. If there is no cached data, nothing will be output.
-- it is. If the data is a table then <code>format_data_for_output</code> is called. If there is no cached data, nothing will be output.
-- @param ip String representing the Target's IP address.
-- @param services_queried Table of strings. Each is the id of a whois service queried for the Target (tracking.completed).
-- @return String - Host Script Results.
@@ -1825,7 +1825,7 @@ end
---
-- Uses fetchfile() to get the path of the parent directory of the supplied Nmap datafile filename.
-- Uses <code>nmap.fetchfile</code> to get the path of the parent directory of the supplied Nmap datafile filename.
-- @param fname String - Filename of an Nmap datafile.
-- @return String - The filepath of the directory containing the supplied filename including the trailing slash (or nil in case of an error).
-- @return Nil or error message in case of an error.
@@ -1961,7 +1961,7 @@ end
-- @param url String representing the full URL of the remote resource.
-- @param mod_date String representing an HTTP date.
-- @param e_tag String representing an HTTP entity tag.
-- @return Table as per http.request() or nil in case of a non-HTTP error.
-- @return Table as per <code>http.request</code> or <code>nil</code> in case of a non-HTTP error.
-- @return Nil or error message in case of an error.
-- @see http.request
@@ -2165,7 +2165,7 @@ end
--
-- Passed to table.sort(), will sort a table of IP assignments such that sub-assignments appear before their parent.
-- Passed to <code>table.sort</code>, will sort a table of IP assignments such that sub-assignments appear before their parent.
-- This function is not in use at the moment (see get_local_assignments_data) and will not appear in nse documentation.
-- @param first Table { range = { first = IP_addr, last = IP_addr } }
-- @param second Table { range = { first = IP_addr, last = IP_addr } }