mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 21:21:31 +00:00
Revert "NSE: make minor adjustments to script"
This reverts commit 317eb0de31f40454cd213296e6cee71c1f78e006. This commit started as a way to fix perceived problems but eventually I found the script worked correctly (I had a misunderstanding of the purpose). I kept the small changes but ended up breaking the script anyway. So let's just revert this.
This commit is contained in:
@@ -33,7 +33,7 @@ categories = { "vuln", "discovery", "safe" }
|
|||||||
portrule = shortport.http
|
portrule = shortport.http
|
||||||
|
|
||||||
local function generateHttpV1_0Req(host, port, path)
|
local function generateHttpV1_0Req(host, port, path)
|
||||||
local privateIP
|
local redirectIP, privateIP
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
socket:connect(host, port)
|
socket:connect(host, port)
|
||||||
|
|
||||||
@@ -47,23 +47,25 @@ local function generateHttpV1_0Req(host, port, path)
|
|||||||
end
|
end
|
||||||
|
|
||||||
-- Check if the response contains a location header
|
-- Check if the response contains a location header
|
||||||
local location = lines:match("Location: ([%a%p%d]+)")
|
if lines:match("Location") then
|
||||||
if location then
|
local locTarget = lines:match("Location: [%a%p%d]+")
|
||||||
stdnse.debug1("Location: %s", location)
|
|
||||||
|
|
||||||
-- Check if the redirect location contains an IP address
|
-- Check if the redirect location contains an IP address
|
||||||
if ipOps.isPrivate(location) then
|
redirectIP = locTarget:match("[%d%.]+")
|
||||||
privateIP = location
|
if redirectIP then
|
||||||
stdnse.debug1("Internal IP: %s", privateIP)
|
privateIP, _ = ipOps.isPrivate(redirectIP)
|
||||||
break
|
|
||||||
end
|
end
|
||||||
|
|
||||||
|
stdnse.debug1("Location: %s", locTarget )
|
||||||
|
stdnse.debug1("Internal IP: %s", redirectIP )
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
socket:close()
|
socket:close()
|
||||||
|
|
||||||
-- Only report if the internal IP leaked is different then the target IP
|
-- Only report if the internal IP leaked is different then the target IP
|
||||||
return privateIP
|
if privateIP and redirectIP ~= host.ip then
|
||||||
|
return redirectIP
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|||||||
Reference in New Issue
Block a user