mirror of
https://github.com/nmap/nmap.git
synced 2025-12-06 12:41:29 +00:00
http-drupal-enum replaces http-drupal-modules.
The script now supports drupal theme listing as well. Updated drupal-modules.lst and added drupal-themes.lst.
This commit is contained in:
gyani
File diff suppressed because it is too large
Load Diff
1333
nselib/data/drupal-themes.lst
Normal file
1333
nselib/data/drupal-themes.lst
Normal file
File diff suppressed because it is too large
Load Diff
229
scripts/http-drupal-enum.nse
Normal file
229
scripts/http-drupal-enum.nse
Normal file
@@ -0,0 +1,229 @@
|
||||
local coroutine = require "coroutine"
|
||||
local http = require "http"
|
||||
local io = require "io"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Enumerates the installed Drupal modules/themes by using a list of known modules and themes.
|
||||
|
||||
The script works by iterating over module/theme names and requesting
|
||||
MODULES_PATH/MODULE_NAME/LICENSE.txt for modules and THEME_PATH/THEME_NAME/LOGO.png.
|
||||
MODULES_PATH is either provided by the user, grepped for in the html body
|
||||
or defaulting to sites/all/modules/.
|
||||
|
||||
If the response status code is 200, it means that the module/theme is installed. By
|
||||
default, the script checks for the top 100 modules (by downloads), given the
|
||||
huge number of existing modules (~10k).
|
||||
|
||||
If you want to update your themes or module list refer to.
|
||||
*https://svn.nmap.org/nmap-exp/gyani/misc/drupal-update.py
|
||||
]]
|
||||
|
||||
---
|
||||
-- @args http-drupal-enum.root The base path. Defaults to <code>/</code>.
|
||||
-- @args http-drupal-enum.number Number of modules to check.
|
||||
-- Use this option with a number or "all" as an argument to test for all modules.
|
||||
-- Defaults to <code>100</code>.
|
||||
-- @args http-drupal-enum.modules_path Direct Path for Modules
|
||||
-- @args http-drupal-enum.themes_path Direct Path for Themes
|
||||
-- @args http-drupal-enum.type default all.choose between "themes" and "modules"
|
||||
-- @usage
|
||||
-- nmap -p 80 --script http-drupal-enum --script-args modules_path="sites/all/modules/",themes_path="themes/",number=10 <target>
|
||||
--
|
||||
--
|
||||
-- @output
|
||||
-- PORT STATE SERVICE REASON
|
||||
-- 80/tcp open http syn-ack
|
||||
-- | http-drupal-enum:
|
||||
-- | Themes:
|
||||
-- | adaptivetheme
|
||||
-- | Modules:
|
||||
-- | views
|
||||
-- | token
|
||||
-- | ctools
|
||||
-- | pathauto
|
||||
-- | date
|
||||
-- | imce
|
||||
-- |_ webform
|
||||
--
|
||||
-- Final times for host: srtt: 329644 rttvar: 185712 to: 1072492
|
||||
--
|
||||
-- @xmloutput
|
||||
-- <table key="Themes">
|
||||
-- <elem>adaptivetheme</elem>
|
||||
-- </table>
|
||||
-- <table key="Modules">
|
||||
-- <elem>views</elem>
|
||||
-- <elem>token</elem>
|
||||
-- <elem>ctools</elem>
|
||||
-- <elem>pathauto</elem>
|
||||
-- <elem>date</elem>
|
||||
-- <elem>imce</elem>
|
||||
-- <elem>webform</elem>
|
||||
-- </table>
|
||||
|
||||
|
||||
author = {
|
||||
"Hani Benhabiles",
|
||||
"Gyanendra Mishra",
|
||||
}
|
||||
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {
|
||||
"discovery",
|
||||
"intrusive",
|
||||
}
|
||||
|
||||
local DEFAULT_SEARCH_LIMIT = 100
|
||||
local DEFAULT_MODULES_PATH = 'sites/all/modules/'
|
||||
local DEFAULT_THEMES_PATH = 'sites/all/themes/'
|
||||
local IDENTIFICATION_STRING = "GNU GENERAL PUBLIC LICENSE"
|
||||
|
||||
portrule = shortport.http
|
||||
|
||||
--Reads database
|
||||
local function read_data (file)
|
||||
return coroutine.wrap(function ()
|
||||
for line in file:lines() do
|
||||
if not line:match "^%s*#" and not line:match "^%s*$" then
|
||||
coroutine.yield(line)
|
||||
end
|
||||
end
|
||||
end)
|
||||
end
|
||||
|
||||
--Checks if the module/theme file exists
|
||||
local function assign_file (act_file)
|
||||
if not act_file then
|
||||
return false
|
||||
end
|
||||
local temp_file = io.open(act_file, "r")
|
||||
if not temp_file then
|
||||
return false
|
||||
end
|
||||
return temp_file
|
||||
end
|
||||
|
||||
--- Attempts to find modules path
|
||||
local get_path = function (host, port, root, type_of)
|
||||
local default_path
|
||||
if type_of == "themes" then
|
||||
default_path = DEFAULT_THEMES_PATH
|
||||
else
|
||||
default_path = DEFAULT_MODULES_PATH
|
||||
end
|
||||
local body = http.get(host, port, root).body or ""
|
||||
local pattern = "sites/[%w.-/]*/" .. type_of .. "/"
|
||||
local found_path = body:match(pattern)
|
||||
return found_path or default_path
|
||||
end
|
||||
|
||||
|
||||
function action (host, port)
|
||||
local result = stdnse.output_table()
|
||||
local file = {}
|
||||
local all = {}
|
||||
local requests = {}
|
||||
local method = "HEAD"
|
||||
|
||||
--Read script arguments
|
||||
local resource_type = stdnse.get_script_args(SCRIPT_NAME .. ".type") or "all"
|
||||
local root = stdnse.get_script_args(SCRIPT_NAME .. ".root") or "/"
|
||||
local search_limit = stdnse.get_script_args(SCRIPT_NAME .. ".number") or DEFAULT_SEARCH_LIMIT
|
||||
local themes_path = stdnse.get_script_args(SCRIPT_NAME .. ".themes_path")
|
||||
local modules_path = stdnse.get_script_args(SCRIPT_NAME .. ".modules_path")
|
||||
|
||||
local themes_file = nmap.fetchfile "nselib/data/drupal-themes.lst"
|
||||
local modules_file = nmap.fetchfile "nselib/data/drupal-modules.lst"
|
||||
|
||||
if resource_type == "themes" or resource_type == "all" then
|
||||
local theme_db = assign_file(themes_file)
|
||||
if not theme_db then
|
||||
return false, "Couldn't find drupal-themes.lst in /nselib/data/"
|
||||
else
|
||||
file['Themes'] = theme_db
|
||||
end
|
||||
end
|
||||
|
||||
if resource_type == "modules" or resource_type == "all" then
|
||||
local modules_db = assign_file(modules_file)
|
||||
if not modules_db then
|
||||
return false, "Couldn't find drupal-modules.lst in /nselib/data/"
|
||||
else
|
||||
file['Modules'] = modules_db
|
||||
end
|
||||
end
|
||||
|
||||
if search_limit == "all" then
|
||||
search_limit = nil
|
||||
else
|
||||
search_limit = tonumber(search_limit)
|
||||
end
|
||||
|
||||
if not themes_path then
|
||||
themes_path = (root .. get_path(host, port, root, "themes")):gsub("//", "/")
|
||||
end
|
||||
if not modules_path then
|
||||
modules_path = (root .. get_path(host, port, root, "modules")):gsub("//", "/")
|
||||
end
|
||||
|
||||
-- We default to HEAD requests unless the server returns
|
||||
-- non 404 (200 or other) status code
|
||||
|
||||
local response = http.head(host, port, modules_path .. stdnse.generate_random_string(8) .. "/LICENSE.txt")
|
||||
if response.status ~= 404 then
|
||||
method = "GET"
|
||||
end
|
||||
|
||||
for key, value in pairs(file) do
|
||||
local count = 0
|
||||
for resource_name in read_data(value) do
|
||||
count = count + 1
|
||||
if search_limit and count > search_limit then
|
||||
break
|
||||
end
|
||||
-- add request to pipeline
|
||||
if key == "Modules" then
|
||||
all = http.pipeline_add(modules_path .. resource_name .. "/LICENSE.txt", nil, all, method)
|
||||
else
|
||||
all = http.pipeline_add(themes_path .. resource_name .. "/LICENSE.txt", nil, all, method)
|
||||
end
|
||||
-- add to requests buffer
|
||||
table.insert(requests, resource_name)
|
||||
end
|
||||
|
||||
-- send requests
|
||||
local pipeline_responses = http.pipeline_go(host, port, all)
|
||||
if not pipeline_responses then
|
||||
stdnse.print_debug(1, "No answers from pipelined requests")
|
||||
return nil
|
||||
end
|
||||
|
||||
for i, response in ipairs(pipeline_responses) do
|
||||
-- Module exists if 200 on HEAD
|
||||
-- or contains identification string for GET or key is themes and is image
|
||||
if response.status == 200 and (method == "HEAD" or (method == "GET" and response.body:match(IDENTIFICATION_STRING))) then
|
||||
result[key] = result[key] or {}
|
||||
table.insert(result[key], requests[i])
|
||||
end
|
||||
end
|
||||
requests = {}
|
||||
all = {}
|
||||
end
|
||||
|
||||
if result['Themes'] or result['Modules'] then
|
||||
return result
|
||||
else
|
||||
if nmap.verbosity() > 1 then
|
||||
return string.format("Nothing found amongst the top %s resources," .. "use --script-args number=<number|all> for deeper analysis)", search_limit)
|
||||
else
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
@@ -1,138 +0,0 @@
|
||||
local http = require "http"
|
||||
local io = require "io"
|
||||
local nmap = require "nmap"
|
||||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Enumerates the installed Drupal modules by using a list of known modules.
|
||||
|
||||
The script works by iterating over module names and requesting
|
||||
MODULES_PATH/MODULE_NAME/LICENSE.txt. MODULES_PATH is either provided by the
|
||||
user, grepped for in the html body or defaulting to sites/all/modules/. If the
|
||||
response status code is 200, it means that the module is installed. By
|
||||
default, the script checks for the top 100 modules (by downloads), given the
|
||||
huge number of existing modules (~10k).
|
||||
]]
|
||||
|
||||
---
|
||||
-- @args http-drupal-modules.root The base path. Defaults to <code>/</code>.
|
||||
-- @args http-drupal-modules.number Number of modules to check.
|
||||
-- Use this option with a number or "all" as an argument to test for all modules.
|
||||
-- Defaults to <code>100</code>.
|
||||
-- @args http-drupal-modules.modules_path The path to the modules folder. If not set, the script will try to
|
||||
-- find the path or default to <code>sites/all/modules/</code>
|
||||
--
|
||||
-- @usage
|
||||
-- nmap --script=http-drupal-modules --script-args http-drupal-modules.root="/path/",http-drupal-modules.number=1000 <targets>
|
||||
--
|
||||
--@output
|
||||
-- Interesting ports on my.woot.blog (123.123.123.123):
|
||||
-- PORT STATE SERVICE REASON
|
||||
-- 80/tcp open http syn-ack
|
||||
-- | http-drupal-modules:
|
||||
-- | views
|
||||
-- | token
|
||||
-- | cck
|
||||
-- | pathauto
|
||||
-- | ctools
|
||||
-- | admin_menu
|
||||
-- | imageapi
|
||||
-- | filefield
|
||||
-- | date
|
||||
-- | imagecache
|
||||
-- | imagefield
|
||||
-- | google_analytics
|
||||
-- | webform
|
||||
-- | jquery_ui
|
||||
-- |_ link
|
||||
|
||||
author = "Hani Benhabiles"
|
||||
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
categories = {"discovery", "intrusive"}
|
||||
|
||||
|
||||
portrule = shortport.service("http")
|
||||
|
||||
--- Attempts to find modules path
|
||||
--@param host nmap host table
|
||||
--@param port nmap port table
|
||||
--@param root Where to grep for the modules base path
|
||||
local get_modules_path = function(host, port, root)
|
||||
local default_path = "sites/all/modules/"
|
||||
local modules_path = stdnse.get_script_args(SCRIPT_NAME .. '.modules_path')
|
||||
|
||||
if modules_path == nil then
|
||||
local body = http.get(host, port, root).body
|
||||
modules_path = body:match "sites/[%w.-]*/modules/"
|
||||
end
|
||||
return modules_path or default_path
|
||||
end
|
||||
|
||||
|
||||
action = function(host, port)
|
||||
local root = stdnse.get_script_args(SCRIPT_NAME .. '.root') or "/"
|
||||
local result = stdnse.output_table()
|
||||
local all = {}
|
||||
local requests = {}
|
||||
local count = 0
|
||||
local method = "HEAD"
|
||||
local identification_string = "GNU GENERAL PUBLIC LICENSE"
|
||||
|
||||
-- Default number of modules to be checked.
|
||||
local modules_limit = stdnse.get_script_args(SCRIPT_NAME .. '.number')
|
||||
if modules_limit == 'all' then
|
||||
modules_limit = nil
|
||||
elseif modules_limit == nil then
|
||||
modules_limit = 100
|
||||
else
|
||||
modules_limit = tonumber(modules_limit)
|
||||
end
|
||||
|
||||
local modules_path = get_modules_path(host, port, root)
|
||||
--Check modules list
|
||||
local drupal_modules_list = nmap.fetchfile("nselib/data/drupal-modules.lst")
|
||||
if not drupal_modules_list then
|
||||
return false, "Couldn't find nselib/data/drupal-modules.lst"
|
||||
end
|
||||
|
||||
-- We default to HEAD requests unless the server returns
|
||||
-- non 404 (200 or other) status code
|
||||
local response = http.head(host,port,root .. modules_path .. "randomaBcD/LICENSE.txt")
|
||||
if response.status ~= 404 then
|
||||
method = "GET"
|
||||
end
|
||||
|
||||
for module_name in io.lines(drupal_modules_list) do
|
||||
count = count + 1
|
||||
if modules_limit and count>modules_limit then break end
|
||||
-- add request to pipeline
|
||||
all = http.pipeline_add(root .. modules_path.. module_name .. "/LICENSE.txt",
|
||||
nil, all, method)
|
||||
-- add to requests buffer
|
||||
table.insert(requests, module_name)
|
||||
end
|
||||
|
||||
-- send requests
|
||||
local pipeline_responses = http.pipeline_go(host, port, all)
|
||||
if not pipeline_responses then
|
||||
stdnse.debug1("No answers from pipelined requests", SCRIPT_NAME)
|
||||
return nil
|
||||
end
|
||||
|
||||
for i, response in pairs(pipeline_responses) do
|
||||
-- Module exists if 200 on HEAD
|
||||
-- or contains identification string for GET
|
||||
if method == "HEAD" and response.status == 200 or
|
||||
method == "GET" and response.status == 200 and
|
||||
string.match(response.body, identification_string) then
|
||||
table.insert(result, requests[i])
|
||||
end
|
||||
end
|
||||
|
||||
return result
|
||||
end
|
||||
Reference in New Issue
Block a user