PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-10 09:49:05 +00:00
Code Issues Projects Releases Wiki Activity

fix a NSE bug when http-cross-domain-policy has no output. Closes #343

Browse Source
This commit is contained in:
dmiller
2016-03-21 22:04:42 +00:00
parent dcfd7562f2
commit b76257d14b
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/http-cross-domain-policy.nse
View File

@@ -279,16 +279,16 @@ Forgery attacks, and may allow third parties to access sensitive data meant for
} }
local check, domains, domains_available, content = check_crossdomain(host, port, lookup) local check, domains, domains_available, content = check_crossdomain(host, port, lookup)
local mt = {__tostring=function(p) return ("%s:\n %s"):format(p.name, p.body:gsub("\n", "\n ")) end} local mt = {__tostring=function(p) return ("%s:\n %s"):format(p.name, p.body:gsub("\n", "\n ")) end}
for i, _ in pairs(content) do
setmetatable(content[i], mt)
tostring(content[i])
end
if check then if check then
if stdnse.contains(domains, "*") or stdnse.contains(domains, "https://") or stdnse.contains(domains, "http://") then if stdnse.contains(domains, "*") or stdnse.contains(domains, "https://") or stdnse.contains(domains, "http://") then
vuln.state = vulns.STATE.VULN vuln.state = vulns.STATE.VULN
else else
vuln.state = vulns.STATE.LIKELY_VULN vuln.state = vulns.STATE.LIKELY_VULN
end end
for i, _ in pairs(content) do
setmetatable(content[i], mt)
tostring(content[i])
end
vuln.check_results = content vuln.check_results = content
vuln.extra_info = string.format("Trusted domains:%s\n", stdnse.strjoin(', ', domains)) vuln.extra_info = string.format("Trusted domains:%s\n", stdnse.strjoin(', ', domains))
if not(lookup) and nmap.verbosity()>=2 then if not(lookup) and nmap.verbosity()>=2 then