From 71439bcfac0cace1b98bffefe558362817c83583 Mon Sep 17 00:00:00 2001 From: tomsellers Date: Wed, 4 Jul 2012 15:16:46 +0000 Subject: [PATCH] Patch to fix script issue when scanning HTTP servers that return 200 to every request. This causes the sanity check on line 88 to fail to trigger because the header value Server is nil. Implemented a check to if the target is returning 200 to all requests. Also implemented additional logic on line 84 to verify that the Server header value is not nil. This is just in case we run into another case where a response is 200 but the Server header does not exist. --- scripts/membase-http-info.nse | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/membase-http-info.nse b/scripts/membase-http-info.nse index 28f51f690..ed05ecb00 100644 --- a/scripts/membase-http-info.nse +++ b/scripts/membase-http-info.nse @@ -81,7 +81,7 @@ local order = { local function cmdReq(host, port, url, result) local response = http.get(host, port, url) - if ( 200 ~= response.status ) then + if ( 200 ~= response.status ) or ( response.header['server'] == nil ) then return false end @@ -120,6 +120,12 @@ local function cmdReq(host, port, url, result) end action = function(host, port) + + -- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests + local _, http_status, _ = http.identify_404( host.ip,port) + if ( http_status == 200 ) then + return false + end local urls = { "/pools/default/buckets", "/pools" }