PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Scripts now use fallback requests when valid codes are received but pattern was not found.

Browse Source 
Scripts now use the lib proxy.lua to perform similar tasks
This commit is contained in:
joao
2009-07-30 02:08:55 +00:00
parent 928de03d3d
commit c24c728b5d
2 changed files with 293 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

264
scripts/http-open-proxy.nse
View File

@@ -11,8 +11,8 @@ web page from www.google.com.
]]
---
-- @args openproxy.url Url that will be requested to the proxy
-- @args openproxy.pattern Pattern that will be searched inside the request results
-- @args proxy.url Url that will be requested to the proxy
-- @args proxy.pattern Pattern that will be searched inside the request results
-- @output
-- Interesting ports on scanme.nmap.org (64.13.134.52):
-- PORT STATE SERVICE
@@ -35,8 +35,7 @@ web page from www.google.com.
--
-- @usage
-- nmap --script http-open-proxy.nse \
-- --script-args 'openproxy={url=<url>,pattern=<pattern>}'
-- --script-args proxy.url=<url>,proxy.pattern=<pattern>
author = "Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
@@ -45,112 +44,179 @@ require "comm"
require "shortport"
require "stdnse"
require "url"
require "proxy"
--- check function, makes checkings for all valid returned status
--- If any of the HTTP status below is found, the proxy is potentially open
--@param result connection result
--@return true if any of the status is found, otherwise false
function check_code(result)
if string.match(result:lower(),"^http/%d\.%d%s*200") then return true end
if string.match(result:lower(),"^http/%d\.%d%s*30[12]") then return true end
return false
--- Performs the custom test, with user's arguments
-- @param host The host table
-- @param port The port table
-- @param test_url The url te send the request
-- @param pattern The pattern to check for valid result
-- @return status (if any request was succeded
-- @return response String with supported methods
function custom_test(host, port, test_url, pattern)
local lstatus = false
local response = ""
-- if pattern is not used, result for test is code check result.
-- otherwise it is pattern check result.
-- strip hostname
if not string.match(test_url, "^http://.*") then
test_url = "http://" .. test_url
stdnse.print_debug("URL missing scheme. URL concatenated to http://")
end
local url_table = url.parse(test_url)
local hostname = url_table.host
local get_status = proxy.test_get(host, port, "http", test_url, hostname, pattern)
local head_status = proxy.test_head(host, port, "http", test_url, hostname, pattern)
local conn_status = proxy.test_connect(host, port, "http", hostname)
if get_status then
lstatus = true
response = response .. " GET"
end
if head_status then
lstatus = true
response = response .. " HEAD"
end
if conn_status then
lstatus = true
response = response .. " CONNECTION"
end
if lstatus then response = "Methods supported: " .. response end
return lstatus, response
end
--- check pattern, searches a pattern inside a response with multiple lines
--@param result Connection result
--@param pattern The pattern to be searched
--@return true if pattern is found, otherwise false
function check_pattern(result, pattern)
local lines = stdnse.strsplit("\n", result)
local i = 1
local n = table.getn(lines)
while true do
if i > n then return false end
if string.match(lines[i]:lower(),pattern) then return true end
i = i + 1
end
end
--- Performs the default test
-- First: Default google request and checks for Server: gws
-- Seconde: Request to wikipedia.org and checks for wikimedia pattern
-- Third: Request to computerhistory.org and checks for museum pattern
--
-- If any of the requests is succesful, the proxy is considered open
-- If all get requests return the same result, the user is alerted that
-- the proxy might be redirecting his requests (very common on wi-fi
-- connections at airports, cafes, etc.)
--
-- @param host The host table
-- @param port The port table
-- @return status (if any request was succeded
-- @return response String with supported methods
function default_test(host, port)
local fstatus = false
local response = ""
local get_status, head_status, conn_status
local get_r1, get_r2, get_r3
local get_cstatus, head_cstatus
local _
--- check, decides what kind of check should be done on the response,
--- depending if a specific pattern is being used
--@param result Connection result
--@param pattern The pattern that should be checked (must be false, in case of
--code check)
--@return true, if the performed check returns true, otherwise false
function check(result, pattern)
if pattern
then return check_pattern(result, pattern)
else return check_code(result)
end
end
-- Start test n1 -> google.com
-- making requests
local test_url = "http://www.google.com"
local hostname = "www.google.com"
local pattern = "^server: gws"
get_status, get_r1, get_cstatus = proxy.test_get(host, port, "http", test_url, hostname, pattern)
head_status, _, head_cstatus = proxy.test_head(host, port, "http", test_url, hostname, pattern)
conn_status = proxy.test_connect(host, port, "http", hostname)
-- checking results
-- conn_status use a different flag (cstatus)
-- because test_connection does not use patterns, so it is unable to detect
-- cases where you receive a valid code, but the response does not match the
-- pattern.
-- if it was using the same flag, program could return without testing GET/HEAD
-- once more before returning
if get_status then fstatus = true; response = response .. " GET" end
if head_status then fstatus = true; response = response .. " HEAD" end
if conn_status then cstatus = true; response = response .. " CONNECTION" end
-- if proxy is open, return it!
if fstatus then return fstatus, "Methods supported: " .. response end
-- if we receive a invalid response, but with a valid
-- response code, we should make a next attempt.
-- if we do not receive any valid status code,
-- there is no reason to keep testing... the proxy is probably not open
if not (get_cstatus or head_cstatus or conn_status) then return false, nil end
stdnse.print_debug("Test 1 - Google Web Server\nReceived valid status codes, but pattern does not match")
test_url = "http://www.wikipedia.org"
hostname = "www.wikipedia.org"
pattern = "wikimedia"
get_status, get_r2, get_cstatus = proxy.test_get(host, port, "http", test_url, hostname, pattern)
head_status, _, head_cstatus = proxy.test_head(host, port, "http", test_url, hostname, pattern)
conn_status = proxy.test_connect(host, port, "http", hostname)
if get_status then fstatus = true; response = response .. " GET" end
if head_status then fstatus = true; response = response .. " HEAD" end
if conn_status then
if not cstatus then response = response .. " CONNECTION" end
cstatus = true
end
if fstatus then return fstatus, "Methods supported: " .. response end
-- same valid code checking as above
if not (get_cstatus or head_cstatus or conn_status) then return false, nil end
stdnse.print_debug("Test 2 - Wikipedia.org\nReceived valid status codes, but pattern does not match")
test_url = "http://www.computerhistory.org"
hostname = "www.computerhistory.org"
pattern = "museum"
get_status, get_r3, get_cstatus = proxy.test_get(host, port, "http", test_url, hostname, pattern)
conn_status = proxy.test_connect(host, port, "http", hostname)
if get_status then fstatus = true; response = response .. " GET" end
if conn_status then
if not cstatus then response = response .. " CONNECTION" end
cstatus = true
end
if fstatus then return fstatus, "Methods supported:" .. response end
if not get_cstatus then
stdnse.print_debug("Test 3 - Computer History\nReceived valid status codes, but pattern does not match")
end
-- Check if GET is being redirected
if proxy.redirectCheck(get_r1, get_r2) and proxy.redirectCheck(get_r2, get_r3) then
return false, "Proxy might be redirecting requests"
end
-- Check if at least CONNECTION worked
if cstatus then return true, "Methods supported:" .. response end
-- Nothing works...
return false, nil
end
portrule = shortport.port_or_service({8123,3128,8000,8080},{'polipo','squid-http','http-proxy'})
action = function(host, port)
local retval
local supported_methods = "\nMethods successfully tested: "
local fstatus = false
local test_url = "http://www.google.com"
local hostname = "www.google.com"
local pattern = "^server: gws"
local response
local i
local retval
local supported_methods = "\nMethods succesfully tested: "
local fstatus = false
local def_test = true
local test_url, pattern
local hostname
-- If arg url exists, use it as test url
if(nmap.registry.args.openproxy and nmap.registry.args.openproxy.url) then
test_url = nmap.registry.args.openproxy.url
pattern = false
if not string.match(test_url, "^http://.*") then
test_url = "http://" .. test_url
stdnse.print_debug("URL missing scheme. URL concatenated to http://")
end
url_table = url.parse(test_url)
hostname = url_table.host
end
if(nmap.registry.args.openproxy and nmap.registry.args.openproxy.pattern) then pattern = ".*" .. nmap.registry.args.openproxy.pattern .. ".*" end
-- Trying GET method!
req = "GET " .. test_url .. " HTTP/1.0\r\nHost: " .. hostname .. "\r\n\r\n"
stdnse.print_debug("GET Request: " .. req)
local status, result = comm.exchange(host, port, req, {lines=1,proto=port.protocol, timeout=10000})
test_url, pattern = proxy.return_args()
if(test_url) then def_test = false end
if(pattern) then pattern = ".*" .. pattern .. ".*" end
if status then
lstatus = check(result, pattern)
if lstatus then
supported_methods = supported_methods .. "GET "
fstatus = true
end
end
if def_test
then fstatus, supported_methods = default_test(host, port)
else fstatus, supported_methods = custom_test(host, port, test_url, pattern);
end
-- Trying HEAD method
req = "HEAD " .. test_url .. " HTTP/1.0\r\nHost: " .. hostname .. "\r\n\r\n"
stdnse.print_debug("HEAD Request: " .. req)
local status, result = comm.exchange(host, port, req, {lines=1,proto=port.protocol, timeout=10000})
-- If any of the tests were OK, then the proxy is potentially open
if fstatus then
retval = "Potentially OPEN proxy.\n" .. supported_methods
return retval
elseif not fstatus and supported_methods then
return supported_methods
end
return
if status then
lstatus = check(result, pattern)
if lstatus then
supported_methods = supported_methods .. "HEAD "
fstatus = true
end
end
-- Trying CONNECT method
req = "CONNECT " .. hostname .. ":80 HTTP/1.0\r\n\r\n"
stdnse.print_debug("CONNECT Request: " .. req)
local status, result = comm.exchange(host, port, req, {lines=1,proto=port.protocol, timeout=10000})
if status then
lstatus = check(result, false);
if lstatus then
supported_methods = supported_methods .. "CONNECT"
fstatus = true
end
end
-- If any of the tests were OK, then the proxy is potentially open
if fstatus then
retval = "Potentially OPEN proxy.\n" .. supported_methods
return retval
end
return
end