diff --git a/scripts/broadcast-pc-anywhere.nse b/scripts/broadcast-pc-anywhere.nse index 673e80644..ececee336 100644 --- a/scripts/broadcast-pc-anywhere.nse +++ b/scripts/broadcast-pc-anywhere.nse @@ -1,5 +1,5 @@ description = [[ -Discovers PC-Anywhere hosts running on the LAN +Sends a special broadcat probe to discover PC-Anywhere hosts running on a LAN ]] --- diff --git a/scripts/broadcast-rip-discover.nse b/scripts/broadcast-rip-discover.nse index 92074b394..b4c0bdd97 100644 --- a/scripts/broadcast-rip-discover.nse +++ b/scripts/broadcast-rip-discover.nse @@ -1,5 +1,5 @@ description=[[ -Discovers devices and routing information from devices running RIPv2 on the +Discovers hosts and routing information from devices running RIPv2 on the LAN. It does so by sending a RIPv2 Request command and collects the responses from all devices responding to the request. ]] diff --git a/scripts/broadcast-wpad-discover.nse b/scripts/broadcast-wpad-discover.nse index dc4392d19..0ab099d39 100644 --- a/scripts/broadcast-wpad-discover.nse +++ b/scripts/broadcast-wpad-discover.nse @@ -1,9 +1,11 @@ description = [[ -Retrieves a list of proxy servers on the LAN using the Web Proxy Autodiscovery Protocol (WPAD). -It implements both the DHCP and DNS methods of doing so and starts by querying DHCP to get the address. -DHCP discovery requires nmap to be running in privileged mode and will be skipped when this is not the case. -DNS discovery relies on the script being able to resolve the local domain either through a script argument or -by attempting to reverse resolve the local IP. +Retrieves a list of proxy servers on the LAN using the Web Proxy +Autodiscovery Protocol (WPAD). It implements both the DHCP and DNS +methods of doing so and starts by querying DHCP to get the address. +DHCP discovery requires nmap to be running in privileged mode and will +be skipped when this is not the case. DNS discovery relies on the +script being able to resolve the local domain either through a script +argument or by attempting to reverse resolve the local IP. ]] --- diff --git a/scripts/dns-blacklist.nse b/scripts/dns-blacklist.nse index da183644a..15fea18b9 100644 --- a/scripts/dns-blacklist.nse +++ b/scripts/dns-blacklist.nse @@ -1,7 +1,8 @@ description = [[ -Checks an IP address against a number of different DNS spam blacklists and returns a list of services where the IP has been blacklisted. -Checks may be limited by service category (eg: SPAM, PROXY) or to a specific service name. -]] +Checks target IP addresses against multiple DNS anti-spam and open +proxy blacklists and returns a list of services where the IP has been +blacklisted. Checks may be limited by service category (eg: SPAM, +PROXY) or to a specific service name. ]] --- -- @usage diff --git a/scripts/hadoop-datanode-info.nse b/scripts/hadoop-datanode-info.nse index 02b584ef0..beed31443 100644 --- a/scripts/hadoop-datanode-info.nse +++ b/scripts/hadoop-datanode-info.nse @@ -22,7 +22,7 @@ For more information about hadoop, see: --- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hadoop-jobtracker-info.nse b/scripts/hadoop-jobtracker-info.nse index 6440e796d..8b0bfa072 100644 --- a/scripts/hadoop-jobtracker-info.nse +++ b/scripts/hadoop-jobtracker-info.nse @@ -39,7 +39,7 @@ For more information about Hadoop, see: -- --- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hadoop-namenode-info.nse b/scripts/hadoop-namenode-info.nse index 4c7284aec..c6e951bb8 100644 --- a/scripts/hadoop-namenode-info.nse +++ b/scripts/hadoop-namenode-info.nse @@ -39,7 +39,7 @@ For more information about Hadoop, see: --- -author = "john.r.bond@gmail.com" +author = "John R. Bond (john.r.bond@gmail.com)" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hadoop-secondary-namenode-info.nse b/scripts/hadoop-secondary-namenode-info.nse index f03cee238..aac9df027 100644 --- a/scripts/hadoop-secondary-namenode-info.nse +++ b/scripts/hadoop-secondary-namenode-info.nse @@ -35,7 +35,7 @@ For more information about Hadoop, see: -- |_ Checkpoint Size: 12345678 MB -- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hadoop-tasktracker-info.nse b/scripts/hadoop-tasktracker-info.nse index 0d3bde417..8150824ee 100644 --- a/scripts/hadoop-tasktracker-info.nse +++ b/scripts/hadoop-tasktracker-info.nse @@ -26,7 +26,7 @@ For more information about Hadoop, see: --- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hbase-master-info.nse b/scripts/hbase-master-info.nse index ed78a9f58..d0447757e 100644 --- a/scripts/hbase-master-info.nse +++ b/scripts/hbase-master-info.nse @@ -36,7 +36,7 @@ For more information about Hbase, see: --- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/hbase-region-info.nse b/scripts/hbase-region-info.nse index 65f8bcb21..74047828a 100644 --- a/scripts/hbase-region-info.nse +++ b/scripts/hbase-region-info.nse @@ -30,7 +30,7 @@ For more information about Hbase, see: --- -author = "john.r.bond@gmail.com" +author = "John R. Bond" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" categories = {"default", "discovery", "safe"} diff --git a/scripts/http-apache-negotiation.nse b/scripts/http-apache-negotiation.nse index 2c725b0d4..51d62da9b 100644 --- a/scripts/http-apache-negotiation.nse +++ b/scripts/http-apache-negotiation.nse @@ -1,13 +1,13 @@ description = [[ -Checks if the target has mod_negotiation is enabled. +Checks if the target http server has mod_negotiation enabled. This +feature can be leveraged to find hidden resources and spider a web +site using fewer requests. The script works by sending requests for resources like index and home without specifying the extension. If mod_negotiate is enabled (default Apache configuration), the target would reply with content-location header containing target resource (such as index.html) and vary header containing "negotiate" depending on the configuration. -This could be leveraged to find hidden resources and spider a web site -using less requests. For more information, see: * http://www.wisec.it/sectou.php?id=4698ebdc59d15 @@ -27,7 +27,7 @@ For more information, see: -- @args http-apache-negotiation.root target web site root. -- Defaults to /. -author = "Hani Benhabiles " +author = "Hani Benhabiles" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" diff --git a/scripts/http-backup-finder.nse b/scripts/http-backup-finder.nse index eed624ee1..7003bd827 100644 --- a/scripts/http-backup-finder.nse +++ b/scripts/http-backup-finder.nse @@ -1,7 +1,6 @@ description = [[ -Spiders a website and attempts to identify backup copies of existing files. -It does so by requesting a number of different combinations of the filename, -such as eg.: index.bak, index.html~, copy of index.html etc. +Spiders a website and attempts to identify backup copies of discovered files. +It does so by requesting a number of different combinations of the filename (eg. index.bak, index.html~, copy of index.html). ]] --- diff --git a/scripts/http-email-harvest.nse b/scripts/http-email-harvest.nse index a83fce90c..4d794656c 100644 --- a/scripts/http-email-harvest.nse +++ b/scripts/http-email-harvest.nse @@ -1,5 +1,5 @@ description = [[ -Spiders a web site and collects e-mail addresses +Spiders a web site and collects e-mail addresses. ]] --- diff --git a/scripts/http-method-tamper.nse b/scripts/http-method-tamper.nse index af41a9730..d62342a3a 100644 --- a/scripts/http-method-tamper.nse +++ b/scripts/http-method-tamper.nse @@ -1,5 +1,5 @@ description = [[ -Checks whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738). +Tests whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738). It works by checking if the target paths require authentication or redirect to a login page that could be bypassed via a HEAD request. RFC 2616 specifies that the HEAD request should be treated exactly like GET but @@ -25,7 +25,7 @@ For more information, see: -- @args http-method-tamper.path Array of paths to check. Defaults -- to {"/jmx-console/"}. -author = "Hani Benhabiles " +author = "Hani Benhabiles" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" diff --git a/scripts/http-open-redirect.nse b/scripts/http-open-redirect.nse index 3cbe28846..eac7d1c42 100644 --- a/scripts/http-open-redirect.nse +++ b/scripts/http-open-redirect.nse @@ -1,6 +1,7 @@ description = [[ -Spiders a website and attempts to identify open redirects. Open redirects are handlers which commonly take a -URL as a parameter and responds with a http redirect (3XX) to the target +Spiders a website and attempts to identify open redirects. Open +redirects are handlers which commonly take a URL as a parameter and +responds with a http redirect (3XX) to the target. ]] --- diff --git a/scripts/http-put.nse b/scripts/http-put.nse index 958279a76..43895a326 100644 --- a/scripts/http-put.nse +++ b/scripts/http-put.nse @@ -1,5 +1,5 @@ description = [[ -Uploads a local file to a remote web server using the HTTP PUT method. +Uploads a local file to a remote web server using the HTTP PUT method. You must specify the filename and URL path with NSE arguments. ]] --- diff --git a/scripts/http-robtex-reverse-ip.nse b/scripts/http-robtex-reverse-ip.nse index 3a8d7d64c..40ec46c63 100644 --- a/scripts/http-robtex-reverse-ip.nse +++ b/scripts/http-robtex-reverse-ip.nse @@ -1,5 +1,5 @@ description = [[ -Obtains up to 100 forward DNS names for a target IP address by querying http://www.robtex.com/ip/. +Obtains up to 100 forward DNS names for a target IP address by querying the Robtex service (http://www.robtex.com/ip/). ]] --- diff --git a/scripts/http-unsafe-output-escaping.nse b/scripts/http-unsafe-output-escaping.nse index 6ce9daf46..53562866d 100644 --- a/scripts/http-unsafe-output-escaping.nse +++ b/scripts/http-unsafe-output-escaping.nse @@ -1,9 +1,11 @@ description = [[ -Spiders a website and attempts to identify and issues with output escaping where content is reflected back to the user. -This script locates all parameters, ?x=foo&y=bar and checks if the values are reflected on the page. If they -are indeed reflected, the script will try to insert ghz>hzx"zxc'xcv and check which (if any) characters were -reflected back onto the page without proper html escaping. -This is an indication of potential XSS issues. +Spiders a website and attempts to identify output escaping problems +where content is reflected back to the user. This script locates all +parameters, ?x=foo&y=bar and checks if the values are reflected on the +page. If they are indeed reflected, the script will try to insert +ghz>hzx"zxc'xcv and check which (if any) characters were reflected +back onto the page without proper html escaping. This is an +indication of potential XSS vulnerability. ]] --- diff --git a/scripts/http-vuln-cve2011-3368.nse b/scripts/http-vuln-cve2011-3368.nse index f2d649ef5..20f5ca964 100644 --- a/scripts/http-vuln-cve2011-3368.nse +++ b/scripts/http-vuln-cve2011-3368.nse @@ -1,5 +1,5 @@ description = [[ -Checks for the CVE-2011-3368 (Reverse Proxy Bypass) vulnerability in Apache HTTP server's reverse proxy mode. +Tests for the CVE-2011-3368 (Reverse Proxy Bypass) vulnerability in Apache HTTP server's reverse proxy mode. The script will run 3 tests: o the loopback test, with 3 payloads to handle different rewrite rules o the internal hosts test. According to Contextis, we expect a delay before a server error. diff --git a/scripts/ms-sql-dump-hashes.nse b/scripts/ms-sql-dump-hashes.nse index 95168bfbf..e2d6324b2 100644 --- a/scripts/ms-sql-dump-hashes.nse +++ b/scripts/ms-sql-dump-hashes.nse @@ -1,7 +1,7 @@ description = [[ Dumps the password hashes from an MS-SQL server in a format suitable for cracking by tools such as John-the-ripper. In order to do so the user -needs to have the appropriate privileges. +needs to have the appropriate DB privileges. Credentials passed as script arguments take precedence over credentials discovered by other scripts. diff --git a/scripts/nexpose-brute.nse b/scripts/nexpose-brute.nse index ea48c788e..560521c09 100644 --- a/scripts/nexpose-brute.nse +++ b/scripts/nexpose-brute.nse @@ -1,5 +1,5 @@ description=[[ -Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1. +Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1. By default it only tries three guesses per username to avoid target account lockout. ]] --- diff --git a/scripts/openlookup-info.nse b/scripts/openlookup-info.nse index 4bc8e641b..f638f73d7 100644 --- a/scripts/openlookup-info.nse +++ b/scripts/openlookup-info.nse @@ -1,5 +1,5 @@ description = [[ -Displays the banner information of an OpenLookup (network key-value store) server. +Parses and displays the banner information of an OpenLookup (network key-value store) server. ]] --- diff --git a/scripts/unusual-port.nse b/scripts/unusual-port.nse index 6159794ec..0029887a8 100644 --- a/scripts/unusual-port.nse +++ b/scripts/unusual-port.nse @@ -1,9 +1,5 @@ description = [[ -Compares the detected service on a port against the expected service -for that port number (e.g. ssh on 22, http on 80) and reports -deviations. The script requires that a version scan has been run in -order to be able to discover what service is actually running on each -port. +Compares the detected service on a port against the expected service for that port number (e.g. ssh on 22, http on 80) and reports deviations. The script requires that a version scan has been run in order to be able to discover what service is actually running on each port. ]] --- diff --git a/scripts/vuze-dht-info.nse b/scripts/vuze-dht-info.nse index 004ca94a0..e97edd86c 100644 --- a/scripts/vuze-dht-info.nse +++ b/scripts/vuze-dht-info.nse @@ -1,5 +1,5 @@ description = [[ -Retrieves some basic information, including protocol version from a Vuze node. +Retrieves some basic information, including protocol version from a Vuze filesharing node. ]] --- @@ -28,6 +28,8 @@ Retrieves some basic information, including protocol version from a Vuze node. -- -- @args vuze-dht-info.allports if set runs this script against every open port +author = "Patrik Karlsson" +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"discovery", "safe"} require 'shortport'