From cf33de55f3774cce687b2425726592e853f60c01 Mon Sep 17 00:00:00 2001 From: ron Date: Sun, 23 Aug 2009 00:24:23 +0000 Subject: [PATCH] Moved the definition for the 'displayall' argument into http.lua. --- nselib/http.lua | 6 ++++++ scripts/http-enum.nse | 3 --- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/nselib/http.lua b/nselib/http.lua index d51fb1f63..5dee3f99c 100644 --- a/nselib/http.lua +++ b/nselib/http.lua @@ -14,6 +14,12 @@ -- concatenated and separated by commas. The body value is a string -- containing the body of the HTTP response. -- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html +-- +--@args displayall Set to '1' or 'true' to treat status codes other than 200 OK and +-- 401 Authentication Required as valid pages. This is generally honoured +-- by scripts that search for valid pages, such as http-enum.nse and +-- http-userdir-enum.nse. Enabling this will create a lot of false positives. + module(... or "http",package.seeall) diff --git a/scripts/http-enum.nse b/scripts/http-enum.nse index f99529c8a..fbf9bfe6b 100644 --- a/scripts/http-enum.nse +++ b/scripts/http-enum.nse @@ -31,9 +31,6 @@ for 404 Not Found and the status code returned by the random files). -- |_ /x_logo.gif Xerox Phaser Printer -- -- ---@args displayall Set to '1' or 'true' to display all status codes that may indicate a valid page, not just --- "200 OK" and "401 Authentication Required" pages. Although this is more likely to find certain --- hidden folders, it also generates far more false positives. --@args limit Limit the number of folders to check. This option is useful if using a list from, for example, -- the DirBuster projects which can have 80,000+ entries.