diff --git a/nselib/http.lua b/nselib/http.lua index d51fb1f63..5dee3f99c 100644 --- a/nselib/http.lua +++ b/nselib/http.lua @@ -14,6 +14,12 @@ -- concatenated and separated by commas. The body value is a string -- containing the body of the HTTP response. -- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html +-- +--@args displayall Set to '1' or 'true' to treat status codes other than 200 OK and +-- 401 Authentication Required as valid pages. This is generally honoured +-- by scripts that search for valid pages, such as http-enum.nse and +-- http-userdir-enum.nse. Enabling this will create a lot of false positives. + module(... or "http",package.seeall) diff --git a/scripts/http-enum.nse b/scripts/http-enum.nse index f99529c8a..fbf9bfe6b 100644 --- a/scripts/http-enum.nse +++ b/scripts/http-enum.nse @@ -31,9 +31,6 @@ for 404 Not Found and the status code returned by the random files). -- |_ /x_logo.gif Xerox Phaser Printer -- -- ---@args displayall Set to '1' or 'true' to display all status codes that may indicate a valid page, not just --- "200 OK" and "401 Authentication Required" pages. Although this is more likely to find certain --- hidden folders, it also generates far more false positives. --@args limit Limit the number of folders to check. This option is useful if using a list from, for example, -- the DirBuster projects which can have 80,000+ entries.