diff --git a/scripts/http-auth.nse b/scripts/http-auth.nse index 825c10ff9..67c611ec5 100644 --- a/scripts/http-auth.nse +++ b/scripts/http-auth.nse @@ -8,8 +8,8 @@ authentication. -- PORT STATE SERVICE REASON -- 80/tcp open http syn-ack -- | http-auth: HTTP/1.1 401 Unauthorized --- | Basic realm=WebAdmin --- |_HTTP server may accept admin:admin combination for Basic authentication. +-- | +-- |_Basic realm=WebAdmin -- HTTP authentication information gathering script -- rev 1.1 (2007-05-25) @@ -21,7 +21,7 @@ author = "Thomas Buchanan" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" -categories = {"default", "auth", "intrusive"} +categories = {"default", "auth"} require "shortport" require "http" @@ -30,11 +30,7 @@ portrule = shortport.http action = function(host, port) local www_authenticate - local challenges, basic_challenge - local authcombinations= { - { username = "admin", password = ""}, - { username = "admin", password = "admin"}, - } + local challenges local result = {} local answer = http.get(host, port, "/") @@ -58,25 +54,13 @@ action = function(host, port) return table.concat(result, "\n") end - basic_challenge = nil for _, challenge in ipairs(challenges) do - if challenge.scheme == "Basic" then - basic_challenge = challenge - end local line = challenge.scheme for name, value in pairs(challenge.params) do line = line .. string.format(" %s=%s", name, value) end result[#result + 1] = line end - if basic_challenge then - for _, auth in ipairs(authcombinations) do - answer = http.get(host, port, '/', {auth = auth}) - if answer.status ~= 401 and answer.status ~= 403 then - result[#result + 1] = string.format("HTTP server may accept %s:%s combination for Basic authentication.", auth.username, auth.password) - end - end - end return table.concat(result, "\n") end diff --git a/scripts/script.db b/scripts/script.db index fd43e0f77..dd69af072 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -54,7 +54,7 @@ Entry { filename = "gopher-ls.nse", categories = { "default", "discovery", "safe Entry { filename = "hddtemp-info.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "hostmap.nse", categories = { "discovery", "external", "intrusive", } } Entry { filename = "http-affiliate-id.nse", categories = { "discovery", "safe", } } -Entry { filename = "http-auth.nse", categories = { "auth", "default", "intrusive", } } +Entry { filename = "http-auth.nse", categories = { "auth", "default", } } Entry { filename = "http-brute.nse", categories = { "auth", "intrusive", } } Entry { filename = "http-date.nse", categories = { "discovery", "safe", } } Entry { filename = "http-domino-enum-passwords.nse", categories = { "auth", "intrusive", } }