PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix false positive in http-phpmyadmin-dir-traversal. Closes #1359

Browse Source
This commit is contained in:
dmiller
2018-10-17 20:21:05 +00:00
parent 02b00238a2
commit 93edeefa3c
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG
View File

@@ -1,5 +1,11 @@
#Nmap Changelog ($Id$); -*-text-*- #Nmap Changelog ($Id$); -*-text-*-
o [NSE][GH#1359] Fix a false-positive in http-phpmyadmin-dir-traversal when the
server responds with 200 status to a POST request to any URI. [Francesco Soncina]
o [NSE] New vulnerability state in vulns.lua, UNKNOWN, is used to indicate that
testing could not rule out vulnerability. [Daniel Miller]
o [NSE] New rand.lua library uses the best sources of random available on the o [NSE] New rand.lua library uses the best sources of random available on the
system to generate random strings. [Daniel Miller] system to generate random strings. [Daniel Miller]

13
scripts/http-phpmyadmin-dir-traversal.nse
View File

@@ -1,3 +1,4 @@
local rand = require "rand"
local shortport = require "shortport" local shortport = require "shortport"
local stdnse = require "stdnse" local stdnse = require "stdnse"
local string = require "string" local string = require "string"
@@ -116,11 +117,19 @@ action = function(host, port)
} }
local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port) local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
local response = http.post(host, port, evil_uri, -- Check if we can distinguish vulnerable from non-vulnerable response
local response = http.post(host, port, "/" .. rand.random_alpha(12),
{header = {["Content-Type"] = "application/x-www-form-urlencoded"}}, nil, evil_postdata)
local testable = true
if response.status == 200 then
testable = false
stdnse.debug1("Server responds with 200 for POST to any URI.")
end
response = http.post(host, port, evil_uri,
{header = {["Content-Type"] = "application/x-www-form-urlencoded"}}, nil, evil_postdata) {header = {["Content-Type"] = "application/x-www-form-urlencoded"}}, nil, evil_postdata)
if response.body and response.status==200 then if response.body and response.status==200 then
stdnse.debug1("response : %s", response.body) stdnse.debug1("response : %s", response.body)
vuln.state = vulns.STATE.EXPLOIT vuln.state = testable and vulns.STATE.EXPLOIT or vulns.STATE.UNKNOWN
vuln.extra_info = rfile.." :\n"..response.body vuln.extra_info = rfile.." :\n"..response.body
if filewrite then if filewrite then
local status, err = write_file(filewrite, response.body) local status, err = write_file(filewrite, response.body)