diff --git a/CHANGELOG b/CHANGELOG index 6fa50aac7..1ca69fa47 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,4 +1,7 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSOCK] Modified multiple scripts that operated against HTTP based services + so as to remove false positives that were generated when the target service + answers with a 200 response to all requests. [Tom Sellers] o [NSE] Added metasploit-info script which uses Metasploit RPC service to get information about the remote system. [Aleksandar Nikolic] diff --git a/scripts/http-cakephp-version.nse b/scripts/http-cakephp-version.nse index a480f596e..36c04f24d 100644 --- a/scripts/http-cakephp-version.nse +++ b/scripts/http-cakephp-version.nse @@ -59,13 +59,14 @@ action = function(host, port) local output_lines local installation_version - local _, http_status, _ = http.identify_404( host.ip,port) - if ( http_status == 200 ) then - stdnse.print_debug(1, "%s:HTTP server always return status 200. Exiting to avoid false positives", SCRIPT_NAME) - return false - end + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404(host,port) + if ( http_status == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end - -- Are the default icons there? + -- Are the default icons there? png_icon_response = http.get(host, port, PNG_ICON_QUERY) gif_icon_response = http.get(host, port, GIF_ICON_QUERY) if png_icon_response.body and png_icon_response.status == 200 then diff --git a/scripts/http-default-accounts.nse b/scripts/http-default-accounts.nse index 33639c68c..c8d06ac95 100644 --- a/scripts/http-default-accounts.nse +++ b/scripts/http-default-accounts.nse @@ -226,6 +226,13 @@ action = function(host, port) local basepath = stdnse.get_script_args("http-default-accounts.basepath") or "/" local output_lns = {} + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404(host,port) + if ( http_status == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end + --Load fingerprint data or abort status, fingerprints = load_fingerprints(fingerprint_filename, category) if(not(status)) then diff --git a/scripts/http-huawei-hg5xx-vuln.nse b/scripts/http-huawei-hg5xx-vuln.nse index 0a0b4ced7..51cd5a70a 100644 --- a/scripts/http-huawei-hg5xx-vuln.nse +++ b/scripts/http-huawei-hg5xx-vuln.nse @@ -81,9 +81,9 @@ including PPPoE credentials, firmware version, model, gateway, dns servers and a } -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests - local _, http_status, _ = http.identify_404(host.ip,port) + local _, http_status, _ = http.identify_404(host,port) if ( http_status == 200 ) then - stdnse.print_debug(1, "%s:Exiting due to ambiguous response from web server. All URIs return status 200", SCRIPT_NAME) + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) return false end diff --git a/scripts/http-malware-host.nse b/scripts/http-malware-host.nse index dd0cf8c6c..e764ad1a2 100644 --- a/scripts/http-malware-host.nse +++ b/scripts/http-malware-host.nse @@ -49,6 +49,12 @@ action = function(host, port) return stdnse.format_output(false, "Unknown pages return a 302 response; unable to check") end + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the test + if ( result_404 == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end + -- Perform a GET request on the file result = http.get_url("http://" .. host.ip .. ":" .. port.number .. "/ts/in.cgi?open2") if(not(result)) then @@ -73,4 +79,3 @@ action = function(host, port) return nil end end - diff --git a/scripts/http-method-tamper.nse b/scripts/http-method-tamper.nse index b6debbf06..a2c0e931c 100644 --- a/scripts/http-method-tamper.nse +++ b/scripts/http-method-tamper.nse @@ -48,6 +48,13 @@ action = function(host, port) paths = { paths } end + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404(host,port) + if ( http_status == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end + -- fallback to jmx-console paths = paths or {"/jmx-console/"} diff --git a/scripts/membase-http-info.nse b/scripts/membase-http-info.nse index 6caa2fd27..82fce4cb2 100644 --- a/scripts/membase-http-info.nse +++ b/scripts/membase-http-info.nse @@ -121,11 +121,12 @@ end action = function(host, port) - -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests - local _, http_status, _ = http.identify_404( host.ip,port) - if ( http_status == 200 ) then - return false - end + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404(host,port) + if ( http_status == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end local urls = { "/pools/default/buckets", "/pools" } diff --git a/scripts/riak-http-info.nse b/scripts/riak-http-info.nse index 19acdb5c6..e0d24e214 100644 --- a/scripts/riak-http-info.nse +++ b/scripts/riak-http-info.nse @@ -113,6 +113,13 @@ action = function(host, port) return end + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404(host,port) + if ( http_status == 200 ) then + stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number) + return false + end + -- Silently abort if the server responds as anything different than -- MochiWeb if ( response.header['server'] and @@ -135,4 +142,4 @@ action = function(host, port) end return stdnse.format_output(true, tab.dump(result)) -end +end \ No newline at end of file