PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Fixed NSEDoc and a comment. Earlier version had some comments from

Browse Source 
the version that checked for LOGO.png instead of LICENSE.txt.

Some Drupal instances returns 200 for all  GET Requests, hence
the check for the identification string was necessary.
This commit is contained in:
gyani
2015-08-14 11:31:36 +00:00
parent 695edff47e
commit 8766678793
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
scripts/http-drupal-enum.nse
View File

@@ -11,16 +11,17 @@ description = [[
Enumerates the installed Drupal modules/themes by using a list of known modules and themes.
The script works by iterating over module/theme names and requesting
MODULES_PATH/MODULE_NAME/LICENSE.txt for modules and THEME_PATH/THEME_NAME/LOGO.png.
MODULES_PATH is either provided by the user, grepped for in the html body
MODULE_PATH/MODULE_NAME/LICENSE.txt for modules and THEME_PATH/THEME_NAME/LICENSE.txt.
MODULE_PATH/THEME_PATH which is either provided by the user, grepped for in the html body
or defaulting to sites/all/modules/.
If the response status code is 200, it means that the module/theme is installed. By
default, the script checks for the top 100 modules (by downloads), given the
huge number of existing modules (~10k).
default, the script checks for the top 100 modules/themes (by downloads), given the
huge number of existing modules (~18k) and themes(~1.4k).
If you want to update your themes or module list refer to.
*https://svn.nmap.org/nmap-exp/gyani/misc/drupal-update.py
If you want to update your themes or module list refer to the link below.
* https://svn.nmap.org/nmap-exp/gyani/misc/drupal-update.py
]]
---
@@ -204,8 +205,9 @@ function action (host, port)
end
for i, response in ipairs(pipeline_responses) do
-- Module exists if 200 on HEAD
-- or contains identification string for GET or key is themes and is image
-- Module exists if 200 on HEAD.
-- A lot Drupal of instances return 200 for all GET requests,
-- hence we check for the identifcation string.
if response.status == 200 and (method == "HEAD" or (method == "GET" and response.body:match(IDENTIFICATION_STRING))) then
result[key] = result[key] or {}
table.insert(result[key], requests[i])