PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-15 04:09:01 +00:00
Code Issues Projects Releases Wiki Activity

Update the script descriptions/nsedoc a bit

Browse Source
This commit is contained in:
fyodor
2012-01-01 22:21:08 +00:00
parent 2461746840
commit 78033599ed
25 changed files with 49 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/broadcast-pc-anywhere.nse
View File

@@ -1,5 +1,5 @@
description = [[
Discovers PC-Anywhere hosts running on the LAN
Sends a special broadcat probe to discover PC-Anywhere hosts running on a LAN
]]
---

2
scripts/broadcast-rip-discover.nse
View File

@@ -1,5 +1,5 @@
description=[[
Discovers devices and routing information from devices running RIPv2 on the
Discovers hosts and routing information from devices running RIPv2 on the
LAN. It does so by sending a RIPv2 Request command and collects the responses
from all devices responding to the request.
]]

12
scripts/broadcast-wpad-discover.nse
View File

@@ -1,9 +1,11 @@
description = [[
Retrieves a list of proxy servers on the LAN using the Web Proxy Autodiscovery Protocol (WPAD).
It implements both the DHCP and DNS methods of doing so and starts by querying DHCP to get the address.
DHCP discovery requires nmap to be running in privileged mode and will be skipped when this is not the case.
DNS discovery relies on the script being able to resolve the local domain either through a script argument or
by attempting to reverse resolve the local IP.
Retrieves a list of proxy servers on the LAN using the Web Proxy
Autodiscovery Protocol (WPAD). It implements both the DHCP and DNS
methods of doing so and starts by querying DHCP to get the address.
DHCP discovery requires nmap to be running in privileged mode and will
be skipped when this is not the case. DNS discovery relies on the
script being able to resolve the local domain either through a script
argument or by attempting to reverse resolve the local IP.
]]
---

7
scripts/dns-blacklist.nse
View File

@@ -1,7 +1,8 @@
description = [[
Checks an IP address against a number of different DNS spam blacklists and returns a list of services where the IP has been blacklisted.
Checks may be limited by service category (eg: SPAM, PROXY) or to a specific service name.
]]
Checks target IP addresses against multiple DNS anti-spam and open
proxy blacklists and returns a list of services where the IP has been
blacklisted. Checks may be limited by service category (eg: SPAM,
PROXY) or to a specific service name. ]]
---
-- @usage

2
scripts/hadoop-datanode-info.nse
View File

@@ -22,7 +22,7 @@ For more information about hadoop, see:
---
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hadoop-jobtracker-info.nse
View File

@@ -39,7 +39,7 @@ For more information about Hadoop, see:
-- ---
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hadoop-namenode-info.nse
View File

@@ -39,7 +39,7 @@ For more information about Hadoop, see:
---
author = "john.r.bond@gmail.com"
author = "John R. Bond (john.r.bond@gmail.com)"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hadoop-secondary-namenode-info.nse
View File

@@ -35,7 +35,7 @@ For more information about Hadoop, see:
-- |_ Checkpoint Size: 12345678 MB
--
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hadoop-tasktracker-info.nse
View File

@@ -26,7 +26,7 @@ For more information about Hadoop, see:
---
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hbase-master-info.nse
View File

@@ -36,7 +36,7 @@ For more information about Hbase, see:
---
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

2
scripts/hbase-region-info.nse
View File

@@ -30,7 +30,7 @@ For more information about Hbase, see:
---
author = "john.r.bond@gmail.com"
author = "John R. Bond"
license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified"
categories = {"default", "discovery", "safe"}

8
scripts/http-apache-negotiation.nse
View File

@@ -1,13 +1,13 @@
description = [[
Checks if the target has mod_negotiation is enabled.
Checks if the target http server has mod_negotiation enabled. This
feature can be leveraged to find hidden resources and spider a web
site using fewer requests.
The script works by sending requests for resources like index and home
without specifying the extension. If mod_negotiate is enabled (default
Apache configuration), the target would reply with content-location header
containing target resource (such as index.html) and vary header containing
"negotiate" depending on the configuration.
This could be leveraged to find hidden resources and spider a web site
using less requests.
For more information, see:
* http://www.wisec.it/sectou.php?id=4698ebdc59d15
@@ -27,7 +27,7 @@ For more information, see:
-- @args http-apache-negotiation.root target web site root.
-- Defaults to <code>/</code>.
author = "Hani Benhabiles <kroosec@gmail.com>"
author = "Hani Benhabiles"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

5
scripts/http-backup-finder.nse
View File

@@ -1,7 +1,6 @@
description = [[
Spiders a website and attempts to identify backup copies of existing files.
It does so by requesting a number of different combinations of the filename,
such as eg.: index.bak, index.html~, copy of index.html etc.
Spiders a website and attempts to identify backup copies of discovered files.
It does so by requesting a number of different combinations of the filename (eg. index.bak, index.html~, copy of index.html).
]]
---

2
scripts/http-email-harvest.nse
View File

@@ -1,5 +1,5 @@
description = [[
Spiders a web site and collects e-mail addresses
Spiders a web site and collects e-mail addresses.
]]
---

4
scripts/http-method-tamper.nse
View File

@@ -1,5 +1,5 @@
description = [[
Checks whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738).
Tests whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738).
It works by checking if the target paths require authentication or redirect to a login page that could be
bypassed via a HEAD request. RFC 2616 specifies that the HEAD request should be treated exactly like GET but
@@ -25,7 +25,7 @@ For more information, see:
-- @args http-method-tamper.path Array of paths to check. Defaults
-- to <code>{"/jmx-console/"}</code>.
author = "Hani Benhabiles <kroosec@gmail.com>"
author = "Hani Benhabiles"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

5
scripts/http-open-redirect.nse
View File

@@ -1,6 +1,7 @@
description = [[
Spiders a website and attempts to identify open redirects. Open redirects are handlers which commonly take a
URL as a parameter and responds with a http redirect (3XX) to the target
Spiders a website and attempts to identify open redirects. Open
redirects are handlers which commonly take a URL as a parameter and
responds with a http redirect (3XX) to the target.
]]
---

2
scripts/http-put.nse
View File

@@ -1,5 +1,5 @@
description = [[
Uploads a local file to a remote web server using the HTTP PUT method.
Uploads a local file to a remote web server using the HTTP PUT method. You must specify the filename and URL path with NSE arguments.
]]
---

2
scripts/http-robtex-reverse-ip.nse
View File

@@ -1,5 +1,5 @@
description = [[
Obtains up to 100 forward DNS names for a target IP address by querying http://www.robtex.com/ip/.
Obtains up to 100 forward DNS names for a target IP address by querying the Robtex service (http://www.robtex.com/ip/).
]]
---

12
scripts/http-unsafe-output-escaping.nse
View File

@@ -1,9 +1,11 @@
description = [[
Spiders a website and attempts to identify and issues with output escaping where content is reflected back to the user.
This script locates all parameters, ?x=foo&y=bar and checks if the values are reflected on the page. If they
are indeed reflected, the script will try to insert ghz>hzx"zxc'xcv and check which (if any) characters were
reflected back onto the page without proper html escaping.
This is an indication of potential XSS issues.
Spiders a website and attempts to identify output escaping problems
where content is reflected back to the user. This script locates all
parameters, ?x=foo&y=bar and checks if the values are reflected on the
page. If they are indeed reflected, the script will try to insert
ghz>hzx"zxc'xcv and check which (if any) characters were reflected
back onto the page without proper html escaping. This is an
indication of potential XSS vulnerability.
]]
---

2
scripts/http-vuln-cve2011-3368.nse
View File

@@ -1,5 +1,5 @@
description = [[
Checks for the CVE-2011-3368 (Reverse Proxy Bypass) vulnerability in Apache HTTP server's reverse proxy mode.
Tests for the CVE-2011-3368 (Reverse Proxy Bypass) vulnerability in Apache HTTP server's reverse proxy mode.
The script will run 3 tests:
o the loopback test, with 3 payloads to handle different rewrite rules
o the internal hosts test. According to Contextis, we expect a delay before a server error.

2
scripts/ms-sql-dump-hashes.nse
View File

@@ -1,7 +1,7 @@
description = [[
Dumps the password hashes from an MS-SQL server in a format suitable for
cracking by tools such as John-the-ripper. In order to do so the user
needs to have the appropriate privileges.
needs to have the appropriate DB privileges.
Credentials passed as script arguments take precedence over credentials
discovered by other scripts.

2
scripts/nexpose-brute.nse
View File

@@ -1,5 +1,5 @@
description=[[
Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1.
Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1. By default it only tries three guesses per username to avoid target account lockout.
]]
---

2
scripts/openlookup-info.nse
View File

@@ -1,5 +1,5 @@
description = [[
Displays the banner information of an OpenLookup (network key-value store) server.
Parses and displays the banner information of an OpenLookup (network key-value store) server.
]]
---

6
scripts/unusual-port.nse
View File

@@ -1,9 +1,5 @@
description = [[
Compares the detected service on a port against the expected service
for that port number (e.g. ssh on 22, http on 80) and reports
deviations. The script requires that a version scan has been run in
order to be able to discover what service is actually running on each
port.
Compares the detected service on a port against the expected service for that port number (e.g. ssh on 22, http on 80) and reports deviations. The script requires that a version scan has been run in order to be able to discover what service is actually running on each port.
]]
---

4
scripts/vuze-dht-info.nse
View File

@@ -1,5 +1,5 @@
description = [[
Retrieves some basic information, including protocol version from a Vuze node.
Retrieves some basic information, including protocol version from a Vuze filesharing node.
]]
---
@@ -28,6 +28,8 @@ Retrieves some basic information, including protocol version from a Vuze node.
--
-- @args vuze-dht-info.allports if set runs this script against every open port
author = "Patrik Karlsson"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}
require 'shortport'