PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Replace inline tabs with spaces.

Browse Source 
Left some in the @output section, since libraries are apparently
emitting tab-separated tables (mysql or mssql)

https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
dmiller
2014-02-03 16:49:26 +00:00
parent 31a2c432e1
commit 63db1bfd12
65 changed files with 159 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scripts/acarsd-info.nse
View File

@@ -32,9 +32,9 @@ For more information about acarsd, see:
-- |_ Frequency: 131.7250 & 131.45
--
-- @args acarsd-info.timeout
-- Set the timeout in seconds. The default value is 10.
-- Set the timeout in seconds. The default value is 10.
-- @args acarsd-info.bytes
-- Set the number of bytes to retrieve. The default value is 512.
-- Set the number of bytes to retrieve. The default value is 512.
--
-- @changelog
-- 2012-02-23 - v0.1 - created by Brendan Coles - itsecuritysolutions.org

2
scripts/ajp-methods.nse
View File

@@ -39,7 +39,7 @@ categories = {"default", "safe"}
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/"
local UNINTERESTING_METHODS = { "GET", "HEAD", "POST", "OPTIONS" }
local UNINTERESTING_METHODS = { "GET", "HEAD", "POST", "OPTIONS" }
local function filter_out(t, filter)
local result = {}

2
scripts/broadcast-db2-discover.nse
View File

@@ -74,7 +74,7 @@ action = function()
status, _, _, ip, _ = socket:get_info()
if ( not(status) ) then return end
if target.ALLOW_NEW_TARGETS then target.add(ip) end
if target.ALLOW_NEW_TARGETS then target.add(ip) end
if ( status ) then
table.insert( result, ("%s - Host: %s; Version: %s"):format(ip, srvname, parseVersion( version ) ) )

2
scripts/broadcast-netbios-master-browser.nse
View File

@@ -41,7 +41,7 @@ action = function()
local BROADCAST_ADDR = "255.255.255.255"
local status, result = netbios.nbquery( { ip = BROADCAST_ADDR }, NBNAME, { multiple = true })
if ( not(status) ) then return end
if ( not(status) ) then return end
local outtab = tab.new(3)
tab.addrow(outtab, 'ip', 'server', 'domain')

6
scripts/broadcast-ripng-discover.nse
View File

@@ -95,9 +95,9 @@ RIPng = {
-- @return o instance of request
new = function(self, entries)
local o = {
command = 1,
version = 1,
entries = entries,
command = 1,
version = 1,
entries = entries,
}
setmetatable(o, self)
self.__index = self

10
scripts/citrix-enum-apps.nse
View File

@@ -82,12 +82,12 @@ action = function(host, port)
--
-- Spec. of response to query[2] that contains a list of published apps
--
-- offset size content
-- offset size content
-- -------------------------
-- 0 16-bit Length
-- 12 32-bit Server IP (not used here)
-- 30 8-bit Last packet (1), More packets(0)
-- 40 - null-separated list of applications
-- 0 16-bit Length
-- 12 32-bit Server IP (not used here)
-- 30 8-bit Last packet(1), More packets(0)
-- 40 - null-separated list of applications
--
query[0] = string.char(
0x1e, 0x00, -- Length: 30

14
scripts/citrix-enum-servers.nse
View File

@@ -79,17 +79,17 @@ action = function(host, port)
--
-- Spec. of response to query[2] that contains a list of published apps
--
-- offset size content
-- offset size content
-- -------------------------
-- 0 16-bit Length
-- 12 32-bit Server IP (not used here)
-- 30 8-bit Last packet (1), More packets(0)
-- 40 - null-separated list of applications
-- 0 16-bit Length
-- 12 32-bit Server IP (not used here)
-- 30 8-bit Last packet(1), More packets(0)
-- 40 - null-separated list of applications
--
query[0] = string.char(
0x1e, 0x00, -- Length: 30
0x01, 0x30, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00
)
@@ -99,7 +99,7 @@ action = function(host, port)
0x01, 0x32, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
)

2
scripts/cvs-brute-repository.nse
View File

@@ -35,7 +35,7 @@ With knowledge of the correct repository name, usernames and passwords can be gu
-- Version 0.2
-- Created 07/13/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
-- Revised 08/07/2012 - v0.2 - revised to suit the changes in brute
-- library [Aleksandar Nikolic]
-- library [Aleksandar Nikolic]
author = "Patrik Karlsson"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

2
scripts/dns-check-zone.nse
View File

@@ -203,7 +203,7 @@ local dns_checks = {
end
local domain_dns = {}
for _,srv in ipairs(res) do domain_dns[srv] = true end
for _,srv in ipairs(res) do domain_dns[srv] = true end
local result = {}
for srv in pairs(domain_dns) do

2
scripts/dns-client-subnet-scan.nse
View File

@@ -343,7 +343,7 @@ action = function(host, port)
end
local addrs = argAddr or areaIPs
if ( "string" == type(addrs) ) then addrs = {{ ip = addrs }} end
if ( "string" == type(addrs) ) then addrs = {{ ip = addrs }} end
local lookup, result = {}, { name = argDomain }
for _,ip in pairs(addrs) do

2
scripts/dns-nsec3-enum.nse
View File

@@ -284,7 +284,7 @@ local function enum(host, port, domain)
todo[b] = h2
break
end
if h1 > b then -- a b h1 h2
if h1 > b then -- a b h1 h2
todo[b] = nil
todo[b] = h1
todo[h2] = a

16
scripts/dns-update.nse
View File

@@ -28,16 +28,16 @@ categories = {"discovery", "safe"}
-- Examples
--
-- Adding different types of records to a server
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="10.10.10.10" } )
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="www.cqure.net" } )
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data={ pref=10, mx="mail.cqure.net"} })
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data={ prio=0, weight=100, port=389, target="ldap.cqure.net" } } )
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="10.10.10.10" } )
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="www.cqure.net" } )
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data={ pref=10, mx="mail.cqure.net"} })
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data={ prio=0, weight=100, port=389, target="ldap.cqure.net" } } )
--
-- Removing the above records by setting an empty data and a ttl of zero
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="", ttl=0 } )
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="", ttl=0 } )
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data="", ttl=0 } )
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data="", ttl=0 } )
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="", ttl=0 } )
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="", ttl=0 } )
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data="", ttl=0 } )
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data="", ttl=0 } )
--
-- Version 0.2

4
scripts/domcon-cmd.nse
View File

@@ -74,7 +74,7 @@ local function readAPIBlock( socket )
local result = {}
local status, line = socket:receive_lines(1)
if ( not(status) ) then return false, "Failed to read line" end
if ( not(status) ) then return false, "Failed to read line" end
lines = stdnse.strsplit( "\n", line )
for _, line in ipairs( lines ) do
@@ -104,7 +104,7 @@ action = function(host, port)
local pass = stdnse.get_script_args('domcon-cmd.pass')
local cmd = stdnse.get_script_args('domcon-cmd.cmd')
if( not(cmd) ) then return " \n ERROR: No command supplied (see domcon-cmd.cmd)" end
if( not(cmd) ) then return " \n ERROR: No command supplied (see domcon-cmd.cmd)" end
if( not(user)) then return " \n ERROR: No username supplied (see domcon-cmd.user)" end
if( not(pass)) then return " \n ERROR: No password supplied (see domcon-cmd.pass)" end

4
scripts/domino-enum-users.nse
View File

@@ -24,8 +24,8 @@ Attempts to discover valid IBM Lotus Domino users and download their ID files by
--
-- @args domino-id.path the location to which any retrieved ID files are stored
-- @args domino-id.username the name of the user from which to retrieve the ID.
-- If this parameter is not specified, the unpwdb library will be used to
-- brute force names of users.
-- If this parameter is not specified, the unpwdb
-- library will be used to brute force names of users.
--
-- For more information see:
-- http://www-01.ibm.com/support/docview.wss?rs=463&uid=swg21248026

2
scripts/eppc-enum-processes.nse
View File

@@ -93,7 +93,7 @@ action = function( host, port )
end
local uid, pid = data:match("uid=(%d+)&pid=(%d+)")
if ( uid and pid ) then tab.addrow( results, app, uid, pid ) end
if ( uid and pid ) then tab.addrow( results, app, uid, pid ) end
try( socket:close() )
end

2
scripts/http-affiliate-id.nse
View File

@@ -119,7 +119,7 @@ local function postaction()
if #siteids[id] > 1 then
local str = id .. ' used by:'
for _, site in ipairs(siteids[id]) do
str = str .. '\n ' .. site
str = str .. '\n ' .. site
end
table.insert(output, str)
end

2
scripts/http-auth-finder.nse
View File

@@ -60,7 +60,7 @@ end
action = function(host, port)
-- create a new crawler instance
local crawler = httpspider.Crawler:new( host, port, nil, { scriptname = SCRIPT_NAME } )
local crawler = httpspider.Crawler:new( host, port, nil, { scriptname = SCRIPT_NAME } )
if ( not(crawler) ) then
return

2
scripts/http-email-harvest.nse
View File

@@ -75,7 +75,7 @@ function action(host, port)
end
-- if no email addresses were collected abort
if ( not(emails) ) then return end
if ( not(emails) ) then return end
local results = {}
for email, _ in pairs(emails) do

2
scripts/http-enum.nse
View File

@@ -313,7 +313,7 @@ local function get_fingerprints(fingerprint_file, category)
end
-- -- If the user wants to try variations, add them
-- -- If the user wants to try variations, add them
-- if(try_variations) then
-- -- Get a list of all variations for this directory
-- local variations = get_variations(entry['checkdir'])

4
scripts/http-grep.nse
View File

@@ -62,8 +62,8 @@ end
action = function(host, port)
-- read script specific arguments
local match = stdnse.get_script_args("http-grep.match")
local break_on_match = stdnse.get_script_args("http-grep.breakonmatch")
local match = stdnse.get_script_args("http-grep.match")
local break_on_match = stdnse.get_script_args("http-grep.breakonmatch")
if ( not(match) ) then
return stdnse.format_output(true, "ERROR: Argument http-grep.match was not set")

4
scripts/http-proxy-brute.nse
View File

@@ -37,8 +37,8 @@ categories = {"brute", "intrusive", "external"}
portrule = shortport.port_or_service({8123,3128,8000,8080},{'polipo','squid-http','http-proxy'})
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. '.url') or 'http://scanme.nmap.org/'
local arg_method = stdnse.get_script_args(SCRIPT_NAME .. '.method') or "HEAD"
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. '.url') or 'http://scanme.nmap.org/'
local arg_method = stdnse.get_script_args(SCRIPT_NAME .. '.method') or "HEAD"
Driver = {

2
scripts/http-slowloris-check.nse
View File

@@ -151,7 +151,7 @@ so, it starves the http server's resources causing Denial Of Service.
-- if second connection died 10 or more seconds after the first
-- it means that sending additional data prolonged the connection's time
-- and the server is vulnerable to slowloris attack
if diff >= 10 then
if diff >= 10 then
stdnse.print_debug("Difference is greater or equal to 10 seconds.")
slowloris.state = vulns.STATE.VULN
end

2
scripts/http-slowloris.nse
View File

@@ -101,7 +101,7 @@ local function set_parameters()
end
local function do_half_http(host, port, obj)
local condvar = nmap.condvar(obj)
local condvar = nmap.condvar(obj)
if StopAll then
condvar("signal")

18
scripts/http-vmware-path-vuln.nse
View File

@@ -77,17 +77,17 @@ local function fake_xml_parse(str, tag)
end
--local function parse_vmware_conf(str, field)
-- local index, value_start = string.find(str, field .. "[^\"]*")
-- if(not(index) or not(value_start)) then
-- return nil
-- end
-- local index, value_start = string.find(str, field .. "[^\"]*")
-- if(not(index) or not(value_start)) then
-- return nil
-- end
--
-- local value_end = string.find(str, "\"", value_start + 1)
-- if(not(value_end)) then
-- return nil
-- end
-- local value_end = string.find(str, "\"", value_start + 1)
-- if(not(value_end)) then
-- return nil
-- end
--
-- return string.sub(str, value_start + 1, value_end - 1)
-- return string.sub(str, value_start + 1, value_end - 1)
--end
local function go(host, port)

4
scripts/http-wordpress-brute.nse
View File

@@ -36,9 +36,9 @@ Wordpress default uri and form names:
-- @args http-wordpress-brute.hostname sets the host header in case of virtual
-- hosting
-- @args http-wordpress-brute.uservar sets the http-variable name that holds the
-- username used to authenticate. Default: log
-- username used to authenticate. Default: log
-- @args http-wordpress-brute.passvar sets the http-variable name that holds the
-- password used to authenticate. Default: pwd
-- password used to authenticate. Default: pwd
-- @args http-wordpress-brute.threads sets the number of threads. Default: 3
--
-- Other useful arguments when using this script are:

8
scripts/ike-version.nse
View File

@@ -31,10 +31,10 @@ portrule = shortport.port_or_service(500, "isakmp", "udp")
--
local function get_version(host, port)
local packet, version, t
local auth = {"psk", "rsa", "Hybrid", "XAUTH"}
local encryption = {"des", "3des", "aes/128", "aes/192", "aes/256"}
local hash = {"md5", "sha1"}
local group = {"768", "1024", "1536"}
local auth = {"psk", "rsa", "Hybrid", "XAUTH"}
local encryption = {"des", "3des", "aes/128", "aes/192", "aes/256"}
local hash = {"md5", "sha1"}
local group = {"768", "1024", "1536"}
-- generate transforms

2
scripts/imap-brute.nse
View File

@@ -25,7 +25,7 @@ Performs brute force password auditing against IMAP servers using either LOGIN,
-- |_ Performed 62 guesses in 10 seconds, average tps: 6
--
-- @args imap-brute.auth authentication mechanism to use LOGIN, PLAIN,
-- CRAM-MD5, DIGEST-MD5 or NTLM
-- CRAM-MD5, DIGEST-MD5 or NTLM
-- Version 0.1
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>

4
scripts/informix-query.nse
View File

@@ -77,10 +77,10 @@ action = function( host, port )
end
status, data = helper:Login(user, pass, nil, db)
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( not(status) ) then return stdnse.format_output(status, data) end
status, data = helper:Query(query)
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( not(status) ) then return stdnse.format_output(status, data) end
for _, rs in ipairs(data) do
table.insert( result, { "User: " .. user, "Database: " .. db, ( "Query: \"%s\"" ):format( rs.query ), name="Information" } )

6
scripts/informix-tables.nse
View File

@@ -89,7 +89,7 @@ action = function( host, port )
end
status, data = helper:Login(user, pass)
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( not(status) ) then return stdnse.format_output(status, data) end
local databases
status, databases = helper:GetDatabases()
@@ -100,9 +100,9 @@ action = function( host, port )
for _, db in ipairs(databases) do
if ( not( excluded_dbs[db] ) ) then
status, data = helper:OpenDatabase(db)
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( not(status) ) then return stdnse.format_output(status, data) end
status, data = helper:Query( query )
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( not(status) ) then return stdnse.format_output(status, data) end
if ( status ) then
data = informix.Util.formatTable( data[1] )

4
scripts/jdwp-exec.nse
View File

@@ -22,7 +22,7 @@ accepts a shell command as its argument.
---
-- @usage nmap -sT <target> -p <port> --script=+jdwp-exec --script-args cmd="date"
--
-- @args jdwp-exec.cmd Command to execute on the remote system.
-- @args jdwp-exec.cmd Command to execute on the remote system.
--
-- @output
-- PORT STATE SERVICE REASON
@@ -81,7 +81,7 @@ action = function(host, port)
stdnse.print_debug(1, "%s: Couldn't create string", SCRIPT_NAME)
return stdnse.format_output(false, cmdID)
end
local runArgs = bin.pack(">CL",0x4c,cmdID) -- 0x4c is object type tag
local runArgs = bin.pack(">CL",0x4c,cmdID) -- 0x4c is object type tag
-- invoke run method
local result
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,1,runArgs)

2
scripts/jdwp-inject.nse
View File

@@ -19,7 +19,7 @@ See nselib/data/jdwp-class/README for more.
---
-- @usage nmap -sT <target> -p <port> --script=+jdwp-inject --script-args filename=HelloWorld.class
--
-- @args jdwp-inject.filename Java <code>.class</code> file to inject.
-- @args jdwp-inject.filename Java <code>.class</code> file to inject.
-- @output
-- PORT STATE SERVICE REASON
-- 2010/tcp open search syn-ack

6
scripts/krb5-enum-users.nse
View File

@@ -76,9 +76,9 @@ KRB5 = {
{ ['aes128-cts-hmac-sha1-96'] = 17 },
{ ['des3-cbc-sha1'] = 16 },
{ ['rc4-hmac'] = 23 },
-- { ['des-cbc-crc'] = 1 },
-- { ['des-cbc-md5'] = 3 },
-- { ['des-cbc-md4'] = 2 }
-- { ['des-cbc-crc'] = 1 },
-- { ['des-cbc-md5'] = 3 },
-- { ['des-cbc-md4'] = 2 }
},
-- A list of principal name types

10
scripts/ldap-novell-getpass.nse
View File

@@ -29,9 +29,9 @@ administrative account.
--
-- @usage
-- nmap -p 636 --script ldap-novell-getpass --script-args \
-- 'ldap-novell-getpass.username="CN=admin,O=cqure", \
-- ldap-novell-getpass.password=pass1234, \
-- ldap-novell-getpass.account="CN=paka,OU=hr,O=cqure"'
-- 'ldap-novell-getpass.username="CN=admin,O=cqure", \
-- ldap-novell-getpass.password=pass1234, \
-- ldap-novell-getpass.account="CN=paka,OU=hr,O=cqure"'
--
-- @output
-- PORT STATE SERVICE REASON
@@ -67,7 +67,7 @@ function action(host,port)
-- do some basic account validation
if ( not(account:match("^[Cc][Nn]=.*,") ) ) then
return "\n ERROR: The account argument should be specified as:\n" ..
" \"CN=name,OU=orgunit,O=org\""
" \"CN=name,OU=orgunit,O=org\""
end
end
@@ -106,7 +106,7 @@ function action(host,port)
data = ldap.encode( { _ldaptype = '30', bin.pack("H", "020102") .. data } )
status = socket:send(data)
if ( not(status) ) then return "ERROR: Failed to send request" end
if ( not(status) ) then return "ERROR: Failed to send request" end
status, data = socket:receive()
if ( not(status) ) then return data end

2
scripts/ms-sql-query.nse
View File

@@ -53,7 +53,7 @@ be disabled using the <code>mssql.scanned-ports-only</code> script argument.
-- Created 01/17/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
-- Revised 02/01/2011 - v0.2 - Added ability to run against all instances on a host;
-- added compatibility with changes in mssql.lua (Chris Woodbury)
-- added compatibility with changes in mssql.lua (Chris Woodbury)
author = "Patrik Karlsson"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

2
scripts/mysql-databases.nse
View File

@@ -42,7 +42,7 @@ portrule = shortport.port_or_service(3306, "mysql")
action = function( host, port )
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local result, response, dbs = {}, nil, {}
local users = {}

2
scripts/mysql-users.nse
View File

@@ -45,7 +45,7 @@ portrule = shortport.port_or_service(3306, "mysql")
action = function( host, port )
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local result, response = {}, nil
local users = {}

2
scripts/mysql-variables.nse
View File

@@ -54,7 +54,7 @@ portrule = shortport.port_or_service(3306, "mysql")
action = function( host, port )
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local result, response = {}, nil
local users = {}

4
scripts/ncp-enum-users.nse
View File

@@ -38,10 +38,10 @@ action = function(host, port)
local helper = ncp.Helper:new(host,port)
local status, resp = helper:connect()
if ( not(status) ) then return stdnse.format_output(false, resp) end
if ( not(status) ) then return stdnse.format_output(false, resp) end
status, resp = helper:search("[Root]", "User", "*")
if ( not(status) ) then return stdnse.format_output(false, resp) end
if ( not(status) ) then return stdnse.format_output(false, resp) end
local output = {}

4
scripts/ncp-serverinfo.nse
View File

@@ -40,10 +40,10 @@ action = function(host, port)
local helper = ncp.Helper:new(host,port)
local status, resp = helper:connect()
if ( not(status) ) then return stdnse.format_output(false, resp) end
if ( not(status) ) then return stdnse.format_output(false, resp) end
status, resp = helper:getServerInfo()
if ( not(status) ) then return stdnse.format_output(false, resp) end
if ( not(status) ) then return stdnse.format_output(false, resp) end
helper:close()

2
scripts/ndmp-fs-info.nse
View File

@@ -49,7 +49,7 @@ action = function(host, port)
local helper = ndmp.Helper:new(host, port)
local status, msg = helper:connect()
if ( not(status) ) then return fail("Failed to connect to server") end
if ( not(status) ) then return fail("Failed to connect to server") end
status, msg = helper:getFsInfo()
if ( not(status) ) then return fail("Failed to get filesystem information from server") end

2
scripts/ndmp-version.nse
View File

@@ -39,7 +39,7 @@ end
action = function(host, port)
local helper = ndmp.Helper:new(host, port)
local status, err = helper:connect()
if ( not(status) ) then return fail("Failed to connect to server") end
if ( not(status) ) then return fail("Failed to connect to server") end
local hi, si
status, hi = helper:getHostInfo()

2
scripts/nessus-xmlrpc-brute.nse
View File

@@ -76,7 +76,7 @@ Driver =
return o
end,
connect = function ( self ) return true end,
connect = function ( self ) return true end,
login = function( self, username, password )

2
scripts/nexpose-brute.nse
View File

@@ -46,7 +46,7 @@ Driver =
return o
end,
connect = function ( self ) return true end,
connect = function ( self ) return true end,
login = function( self, username, password )
local postdata='<?xml version="1.0" encoding="UTF-8"?><LoginRequest sync-id="1" user-id="'..username..'" password="'..password..'"></LoginRequest>'

20
scripts/pjl-ready-message.nse
View File

@@ -40,24 +40,24 @@ end
action = function(host, port)
local status --to be used to grab the existing status of the display screen before changing it.
local newstatus --used to repoll the printer after setting the display to check that the probe worked.
local statusmsg --stores the PJL command to get the printer's status
local response --stores the response sent over the network from the printer by the PJL status command
local status --to be used to grab the existing status of the display screen before changing it.
local newstatus --used to repoll the printer after setting the display to check that the probe worked.
local statusmsg --stores the PJL command to get the printer's status
local response --stores the response sent over the network from the printer by the PJL status command
statusmsg="@PJL INFO STATUS\n"
local rdymsg="" --string containing text to send to the printer.
local rdymsgarg="" --will contain the argument from the command line if one exists
local rdymsg="" --string containing text to send to the printer.
local rdymsgarg="" --will contain the argument from the command line if one exists
local socket = nmap.new_socket()
socket:set_timeout(15000)
local try = nmap.new_try(function() socket:close() end)
try(socket:connect(host, port))
try(socket:send(statusmsg)) --this block gets the current display status
try(socket:send(statusmsg)) --this block gets the current display status
local data
response,data=socket:receive()
if not response then --send an initial probe. If no response, send nothing further.
if not response then --send an initial probe. If no response, send nothing further.
socket:close()
if nmap.verbosity() > 0 then
return "No response from printer: "..data
@@ -85,9 +85,9 @@ action = function(host, port)
end
rdymsg="@PJL RDYMSG DISPLAY = \""..rdymsgarg.."\"\r\n"
try(socket:send(rdymsg)) --actually set the display message here.
try(socket:send(rdymsg)) --actually set the display message here.
try(socket:send(statusmsg)) --this block gets the status again for comparison
try(socket:send(statusmsg)) --this block gets the status again for comparison
response,data=socket:receive()
if not response then
socket:close()

16
scripts/redis-info.nse
View File

@@ -58,15 +58,15 @@ local filter = {
["redis_version"] = { name = "Version", func = cb_parse_version },
["os"] = { name = "Operating System" },
["arch_bits"] = { name = "Architecture", func = cb_parse_architecture },
["process_id"] = { name = "Process ID"},
["uptime"] = { name = "Uptime", func = function(h, p, v) return ("%s seconds"):format(v) end },
["arch_bits"] = { name = "Architecture", func = cb_parse_architecture },
["process_id"] = { name = "Process ID"},
["uptime"] = { name = "Uptime", func = function(h, p, v) return ("%s seconds"):format(v) end },
["used_cpu_sys"]= { name = "Used CPU (sys)"},
["used_cpu_user"] = { name = "Used CPU (user)"},
["connected_clients"] = { name = "Connected clients"},
["connected_slaves"] = { name = "Connected slaves"},
["used_memory_human"] = { name = "Used memory"},
["role"] = { name = "Role"}
["used_cpu_user"] = { name = "Used CPU (user)"},
["connected_clients"] = { name = "Connected clients"},
["connected_slaves"] = { name = "Connected slaves"},
["used_memory_human"] = { name = "Used memory"},
["role"] = { name = "Role"}
}

10
scripts/riak-http-info.nse
View File

@@ -93,13 +93,13 @@ local filter = {
local order = {
"nodename", "sys_system_architecture", "storage_backend", "mem_total",
"crypto_version", "skerl_version", "os_mon_version", "basho_stats_version",
"lager_version", "cluster_info_version", "luke_version", "sasl_version",
"lager_version", "cluster_info_version", "luke_version", "sasl_version",
"sys_driver_version", "bitcask_version", "riak_search_version",
"kernel_version", "stdlib_version", "basho_metrics_version",
"webmachine_version", "public_key_version", "riak_core_version",
"kernel_version", "stdlib_version", "basho_metrics_version",
"webmachine_version", "public_key_version", "riak_core_version",
"riak_pipe_version", "runtime_tools_version", "ssl_version",
"mochiweb_version", "erlang_js_version", "riak_kv_version",
"luwak_version", "merge_index_version", "inets_version", "riak_sysmon_version"
"mochiweb_version", "erlang_js_version", "riak_kv_version",
"luwak_version", "merge_index_version", "inets_version", "riak_sysmon_version"
}

2
scripts/rsync-brute.nse
View File

@@ -36,7 +36,7 @@ portrule = shortport.port_or_service(873, "rsync", "tcp")
Driver = {
new = function(self, host, port, options)
local o = { host = host, port = port, options = options }
local o = { host = host, port = port, options = options }
setmetatable(o, self)
self.__index = self
return o

12
scripts/rtsp-url-brute.nse
View File

@@ -148,17 +148,17 @@ action = function(host, port)
table.insert(failure_urls, r.url)
elseif ( r.status == 200 ) then
table.insert(success_urls, r.url)
-- elseif ( r.status == 401 ) then
-- table.insert(auth_urls, r.url )
-- elseif ( r.status == 401 ) then
-- table.insert(auth_urls, r.url )
end
end
local result = { success_urls, failure_urls }
-- -- insert our URLs requiring auth ONLY if not ALL urls returned auth
-- if (#result > #auth_urls) then
-- table.insert(result, 2, auth_urls)
-- end
-- insert our URLs requiring auth ONLY if not ALL urls returned auth
--if (#result > #auth_urls) then
-- table.insert(result, 2, auth_urls)
--end
return stdnse.format_output(true, result )
end

2
scripts/sip-brute.nse
View File

@@ -68,7 +68,7 @@ Driver = {
return true, brute.Account:new(username, password, creds.State.VALID)
end,
disconnect = function(self) return self.helper:close() end,
disconnect = function(self) return self.helper:close() end,
}
-- Function used to check if we can distinguish existing from non-existing

6
scripts/smb-brute.nse
View File

@@ -325,9 +325,9 @@ local function check_login(hostinfo, username, password, logintype)
local status, err
if(#password == 32 or #password == 64 or #password == 65) then
-- It's a hash (note: we always use NTLM hashes)
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, nil, password, "ntlm"), false)
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, nil, password, "ntlm"), false)
else
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, password, nil, logintype), false)
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, password, nil, logintype), false)
end
if(status == true) then
@@ -1080,7 +1080,7 @@ end
--_G.TRACEBACK = TRACEBACK or {}
action = function(host)
-- TRACEBACK[coroutine.running()] = true;
-- TRACEBACK[coroutine.running()] = true;
local status, result
local response = {}

22
scripts/smb-check-vulns.nse
View File

@@ -172,7 +172,7 @@ function check_ms08_067(host)
end
-- Call netpathcanonicalize
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
local path1 = "\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\..\\n"
local path2 = "\\n"
@@ -435,12 +435,12 @@ end
--its dependencies.
--@param host Host object.
--@return (status, result)
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
--that the targeted Ras RPC service is not active.
--* <code>status == true</code> ->
-- ** <code>result == VULNERABLE</code> for vulnerable.
-- ** <code>result == PATCHED</code> for not vulnerable.
-- ** <code>result == NOTRUN</code> if check skipped.
--* <code>status == true</code> ->
-- ** <code>result == VULNERABLE</code> for vulnerable.
-- ** <code>result == PATCHED</code> for not vulnerable.
-- ** <code>result == NOTRUN</code> if check skipped.
function check_ms06_025(host)
--check for safety flag
if(nmap.registry.args.safe ~= nil) then
@@ -498,12 +498,12 @@ end
--This check is not safe as it crashes the Dns Server RPC service its dependencies.
--@param host Host object.
--@return (status, result)
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
--that the targeted Dns Server RPC service is not active.
--* <code>status == true</code> ->
-- ** <code>result == VULNERABLE</code> for vulnerable.
-- ** <code>result == PATCHED</code> for not vulnerable.
-- ** <code>result == NOTRUN</code> if check skipped.
--* <code>status == true</code> ->
-- ** <code>result == VULNERABLE</code> for vulnerable.
-- ** <code>result == PATCHED</code> for not vulnerable.
-- ** <code>result == NOTRUN</code> if check skipped.
function check_ms07_029(host)
--check for safety flag
if(nmap.registry.args.safe ~= nil) then

2
scripts/smb-system-info.nse
View File

@@ -138,7 +138,7 @@ local function get_info_registry(host)
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
end
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
-- TODO: Known DLLs?

2
scripts/smb-vuln-ms10-061.nse
View File

@@ -160,7 +160,7 @@ aka "Print Spooler Service Impersonation Vulnerability."
local write_result = string.sub(result.data,25,#result.data-4)
stdnse.print_debug("Written %s bytes to a file.",stdnse.tohex(write_result))
if stdnse.tohex(write_result) == "00000000" then -- patched version would report 4 bytes written
ms10_061.state = vulns.STATE.VULN -- identified by diffing patched an unpatched version
ms10_061.state = vulns.STATE.VULN -- identified by diffing patched an unpatched version
end
-- call abort_printer to stop the actuall printing in case the remote system is not vulnerable
-- we care about the environment and don't want to spend more paper then needed :)

2
scripts/smtp-brute.nse
View File

@@ -25,7 +25,7 @@ Performs brute force password auditing against SMTP servers using either LOGIN,
-- |_ Performed 1160 guesses in 41 seconds, average tps: 33
--
-- @args smtp-brute.auth authentication mechanism to use LOGIN, PLAIN,
-- CRAM-MD5, DIGEST-MD5 or NTLM
-- CRAM-MD5, DIGEST-MD5 or NTLM
-- Version 0.1
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>

2
scripts/snmp-hh3c-logins.nse
View File

@@ -123,7 +123,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local data, oldsnmpoid = nil, "1.3.6.1.4.1.2011.10.2.12.1.1.1"
local data, newsnmpoid = nil, "1.3.6.1.4.1.25506.2.12.1.1.1"

2
scripts/snmp-interfaces.nse
View File

@@ -391,7 +391,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
-- IF-MIB - used to look up network interfaces
local if_oid = "1.3.6.1.2.1.2.2.1"

4
scripts/snmp-netstat.nse
View File

@@ -63,7 +63,7 @@ end
local function format_output(tbl, prefix)
local result = {}
for _, v in ipairs(tbl) do
for _, v in ipairs(tbl) do
local value = string.format("%-20s %s", v.left, v.right )
table.insert( result, string.format( "%-4s %s", prefix, value ) )
end
@@ -102,7 +102,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local tcp_oid = "1.3.6.1.2.1.6.13.1.1"
local udp_oid = "1.3.6.1.2.1.7.5.1.1"

2
scripts/snmp-processes.nse
View File

@@ -113,7 +113,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local data, snmpoid = nil, "1.3.6.1.2.1.25.4.2"
local shares = {}

2
scripts/snmp-win32-services.nse
View File

@@ -60,7 +60,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local snmpoid = "1.3.6.1.4.1.77.1.2.3.1.1"
local services = {}

2
scripts/snmp-win32-shares.nse
View File

@@ -79,7 +79,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local data, snmpoid = nil, "1.3.6.1.4.1.77.1.2.27"
local shares = {}

2
scripts/snmp-win32-software.nse
View File

@@ -84,7 +84,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local data, snmpoid = nil, "1.3.6.1.2.1.25.6.3.1"
local sw = {}

2
scripts/snmp-win32-users.nse
View File

@@ -56,7 +56,7 @@ end
action = function(host, port)
local socket = nmap.new_socket()
local catch = function() socket:close() end
local catch = function() socket:close() end
local try = nmap.new_try(catch)
local snmpoid = "1.3.6.1.4.1.77.1.2.25"
local users = {}

8
scripts/telnet-brute.nse
View File

@@ -102,11 +102,11 @@ end
-- @return Verdict (true or false)
local is_login_success = function (str)
pcreptn.login_success = pcreptn.login_success
or pcre.new("[/>%$#]\\s*$" -- general prompt
.. "|^Last login\\s*:" -- linux telnetd
.. "|^(?-i:[A-Z]):\\\\" -- Windows telnet
or pcre.new("[/>%$#]\\s*$" -- general prompt
.. "|^Last login\\s*:" -- linux telnetd
.. "|^(?-i:[A-Z]):\\\\" -- Windows telnet
.. "|Main(?:\\s|\\x1B\\[\\d+;\\d+H)Menu\\b" -- Netgear RM356
.. "|^Enter Terminal Emulation:\\s*$", -- Hummingbird telnetd
.. "|^Enter Terminal Emulation:\\s*$", -- Hummingbird telnetd
pcre.flags().CASELESS, "C")
return pcreptn.login_success:match(str)
end

6
scripts/vnc-info.nse
View File

@@ -49,13 +49,13 @@ action = function(host, port)
local result = stdnse.output_table()
status, data = vnc:connect()
if ( not(status) ) then return " \n ERROR: " .. data end
if ( not(status) ) then return " \n ERROR: " .. data end
status, data = vnc:handshake()
if ( not(status) ) then return " \n ERROR: " .. data end
if ( not(status) ) then return " \n ERROR: " .. data end
status, data = vnc:getSecTypesAsTable()
if ( not(status) ) then return " \n ERROR: " .. data end
if ( not(status) ) then return " \n ERROR: " .. data end
result["Protocol version"] = vnc:getProtocolVersion()

7
scripts/xmpp-brute.nse
View File

@@ -25,9 +25,10 @@ Performs brute force password auditing against XMPP (Jabber) instant messaging s
-- |_ Performed 6237 guesses in 5 seconds, average tps: 1247
--
-- @args xmpp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5
-- or DIGEST-MD5
-- or DIGEST-MD5
-- @args xmpp-brute.servername needed when host name cannot be automatically
-- determined (eg. when running against an IP, instead of hostname)
-- determined (eg. when running against an IP,
-- instead of hostname)
--
-- Version 0.1
@@ -121,7 +122,7 @@ action = function(host, port)
for _, mp in ipairs(mech_prio) do
for m, _ in pairs(mechs) do
if ( mp == m ) then mech = m; break end
if ( mp == m ) then mech = m; break end
end
if ( mech ) then break end
end