PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-24 16:39:03 +00:00
Code Issues Projects Releases Wiki Activity

Remove trailing whitespace in lua files

Browse Source 
Whitespace is not significant, so this should not be a problem.
https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
dmiller
2014-01-23 21:51:58 +00:00
parent 86ac3c0a19
commit 620f9fdb34
499 changed files with 11134 additions and 11134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

108
scripts/http-stored-xss.nse
View File

@@ -1,46 +1,46 @@
description = [[
Posts specially crafted strings to every form it
encounters and then searches through the website for those
Posts specially crafted strings to every form it
encounters and then searches through the website for those
strings to determine whether the payloads were succesful.
]]
---
-- @usage nmap -p80 --script http-stored-xss.nse <target>
--
--
-- This script works in two phases.
-- 1) Posts specially crafted strings to every form it encounters.
-- 2) Crawls through the page searching for these strings.
--
-- If any string is reflected on some page without any proper
-- If any string is reflected on some page without any proper
-- HTML escaping, it's a sign for potential XSS vulnerability.
--
-- @args http-stored-xss.formpaths The pages that contain
-- @args http-stored-xss.formpaths The pages that contain
-- the forms to exploit. For example, {/upload.php, /login.php}.
-- Default: nil (crawler mode on)
-- @args http-stored-xss.uploadspaths The pages that reflect
-- back POSTed data. For example, {/comments.php, /guestbook.php}.
-- back POSTed data. For example, {/comments.php, /guestbook.php}.
-- Default: nil (Crawler mode on)
-- @args http-stored-xss.fieldvalues The script will try to
-- fill every field found in the form but that may fail due to
-- fields' restrictions. You can manually fill those fields using
-- this table. For example, {gender = "male", email = "foo@bar.com"}.
-- @args http-stored-xss.fieldvalues The script will try to
-- fill every field found in the form but that may fail due to
-- fields' restrictions. You can manually fill those fields using
-- this table. For example, {gender = "male", email = "foo@bar.com"}.
-- Default: {}
-- @args http-stored-xss.dbfile The path of a plain text file
-- @args http-stored-xss.dbfile The path of a plain text file
-- that contains one XSS vector per line. Default: nil
--
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-stored-xss:
-- | Found the following stored XSS vulnerabilities:
-- |
-- | http-stored-xss:
-- | Found the following stored XSS vulnerabilities:
-- |
-- | Payload: ghz>hzx
-- | Uploaded on: /guestbook.php
-- | Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
-- | Payload: zxc'xcv
-- | Uploaded on: /guestbook.php
-- | Description: Unfiltered ' (apostrophe). An indication of potential XSS vulnerability.
-- |
-- |
-- | Payload: ghz>hzx
-- | Uploaded on: /posts.php
-- | Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
@@ -48,7 +48,7 @@ strings to determine whether the payloads were succesful.
-- | Uploaded on: /posts.php
-- |_ Description: Unfiltered " (double quotation mark). An indication of potential XSS vulnerability.
--
--
--
--
---
@@ -69,19 +69,19 @@ portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open
-- A list of payloads.
--
-- You can manually add / remove your own payloads but make sure you
-- don't mess up, otherwise the script may succeed when it actually
-- hasn't.
-- You can manually add / remove your own payloads but make sure you
-- don't mess up, otherwise the script may succeed when it actually
-- hasn't.
--
-- Note, that more payloads will slow down your scan.
payloads = {
-- Basic vectors. Each one is an indication of potential XSS vulnerability.
-- Basic vectors. Each one is an indication of potential XSS vulnerability.
{ vector = 'ghz>hzx', description = "Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability." },
{ vector = 'hzx"zxc', description = "Unfiltered \" (double quotation mark). An indication of potential XSS vulnerability." },
{ vector = 'zxc\'xcv', description = "Unfiltered ' (apostrophe). An indication of potential XSS vulnerability." },
}
-- Create customized requests for all of our payloads.
local makeRequests = function(host, port, submission, fields, fieldvalues)
@@ -90,19 +90,19 @@ local makeRequests = function(host, port, submission, fields, fieldvalues)
for _, p in ipairs(payloads) do
for __, field in ipairs(fields) do
if field["type"] == "text" or field["type"] == "textarea" or field["type"] == "radio" or field["type"] == "checkbox" then
local value = fieldvalues[field["name"]]
if value == nil then
value = p.vector
end
postdata[field["name"]] = value
end
end
end
stdnse.print_debug(2, "Making a POST request to " .. submission .. ": ")
for i, content in pairs(postdata) do
for i, content in pairs(postdata) do
stdnse.print_debug(2, i .. ": " .. content)
end
local response = http.post(host, port, submission, { no_cache = true }, nil, postdata)
@@ -111,8 +111,8 @@ local makeRequests = function(host, port, submission, fields, fieldvalues)
end
local checkPayload = function(body, p)
if (body:match(p)) then
if (body:match(p)) then
return true
end
@@ -120,7 +120,7 @@ end
-- Check if the payloads were succesfull by checking the content of pages in the uploadspaths array.
local checkRequests = function(body, target)
local output = {}
for _, p in ipairs(payloads) do
if checkPayload(body, p.vector) then
@@ -146,7 +146,7 @@ action = function(host, port)
local formpaths = stdnse.get_script_args("http-stored-xss.formpaths")
local uploadspaths = stdnse.get_script_args("http-stored-xss.uploadspaths")
local fieldvalues = stdnse.get_script_args("http-stored-xss.fieldvalues") or {}
local dbfile = stdnse.get_script_args("http-stored-xss.dbfile")
local dbfile = stdnse.get_script_args("http-stored-xss.dbfile")
if dbfile then
readFromFile(dbfile)
@@ -162,7 +162,7 @@ action = function(host, port)
end
crawler:set_timeout(10000)
local index, k, target, response
-- Phase 1. Crawls through the website and POSTs malicious payloads.
@@ -173,11 +173,11 @@ action = function(host, port)
k, target = next(formpaths, index)
if (k == nil) then
break
end
response = http.get(host, port, target, { no_cache = true })
end
response = http.get(host, port, target, { no_cache = true })
target = host.name .. target
else
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
@@ -191,26 +191,26 @@ action = function(host, port)
target = tostring(r.url)
response = r.response
end
if response.body then
if response.body then
local forms = http.grab_forms(response.body)
for i, form in ipairs(forms) do
for i, form in ipairs(forms) do
form = http.parse_form(form)
if form then
local action_absolute = string.find(form["action"], "https*://")
-- Determine the path where the form needs to be submitted.
local submission
if action_absolute then
submission = form["action"]
else
else
local path_cropped = string.match(target, "(.*/).*")
path_cropped = path_cropped and path_cropped or ""
submission = path_cropped..form["action"]
@@ -218,17 +218,17 @@ action = function(host, port)
makeRequests(host, port, submission, form["fields"], fieldvalues)
end
end
end
end
if (index) then
index = index + 1
else
else
index = 1
end
end
local crawler = httpspider.Crawler:new( host, port, '/', { scriptname = SCRIPT_NAME } )
local index
@@ -241,7 +241,7 @@ action = function(host, port)
end
response = http.get(host, port, target)
else
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
@@ -255,25 +255,25 @@ action = function(host, port)
target = tostring(r.url)
response = r.response
end
if response.body then
if response.body then
result = checkRequests(response.body, target)
if next(result) then
table.insert(returntable, result)
end
end
end
if (index) then
index = index + 1
else
else
index = 1
end
end
if next(returntable) then
if next(returntable) then
table.insert(returntable, 1, "Found the following stored XSS vulnerabilities: ")
return returntable
else