mirror of
https://github.com/nmap/nmap.git
synced 2025-12-14 11:49:01 +00:00
Re-indent some more scripts. Whitespace-only commit
https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
@@ -145,8 +145,8 @@ action = function(host, port)
|
|||||||
Directory traversal vulnerability in AFP Server in Apple Mac OS X before
|
Directory traversal vulnerability in AFP Server in Apple Mac OS X before
|
||||||
10.6.3 allows remote attackers to list a share root's parent directory.]],
|
10.6.3 allows remote attackers to list a share root's parent directory.]],
|
||||||
references = {
|
references = {
|
||||||
'http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap',
|
'http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap',
|
||||||
'http://support.apple.com/kb/HT1222',
|
'http://support.apple.com/kb/HT1222',
|
||||||
},
|
},
|
||||||
dates = {
|
dates = {
|
||||||
disclosure = {year = '2010', month = '03', day = '29'},
|
disclosure = {year = '2010', month = '03', day = '29'},
|
||||||
|
|||||||
@@ -80,7 +80,7 @@ payloads = {
|
|||||||
{ vector = 'ghz>hzx', description = "Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability." },
|
{ vector = 'ghz>hzx', description = "Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability." },
|
||||||
{ vector = 'hzx"zxc', description = "Unfiltered \" (double quotation mark). An indication of potential XSS vulnerability." },
|
{ vector = 'hzx"zxc', description = "Unfiltered \" (double quotation mark). An indication of potential XSS vulnerability." },
|
||||||
{ vector = 'zxc\'xcv', description = "Unfiltered ' (apostrophe). An indication of potential XSS vulnerability." },
|
{ vector = 'zxc\'xcv', description = "Unfiltered ' (apostrophe). An indication of potential XSS vulnerability." },
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
-- Create customized requests for all of our payloads.
|
-- Create customized requests for all of our payloads.
|
||||||
|
|||||||
@@ -168,7 +168,7 @@ local function split(str, sep)
|
|||||||
local pattern = string.format("([^%s]+)", sep)
|
local pattern = string.format("([^%s]+)", sep)
|
||||||
str:gsub(pattern, function(c) fields[#fields+1] = c end)
|
str:gsub(pattern, function(c) fields[#fields+1] = c end)
|
||||||
return fields
|
return fields
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
--This is a customData formatter. In some cases, the RMI library finds 'custom data' which belongs to an object.
|
--This is a customData formatter. In some cases, the RMI library finds 'custom data' which belongs to an object.
|
||||||
|
|||||||
@@ -138,7 +138,7 @@ local function get_info_registry(host)
|
|||||||
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
|
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
|
||||||
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
|
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
|
||||||
end
|
end
|
||||||
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
||||||
|
|
||||||
-- TODO: Known DLLs?
|
-- TODO: Known DLLs?
|
||||||
|
|
||||||
|
|||||||
@@ -59,15 +59,15 @@ end
|
|||||||
|
|
||||||
local ciphers = function(cipher_list, len)
|
local ciphers = function(cipher_list, len)
|
||||||
|
|
||||||
-- returns names of ciphers supported by the server
|
-- returns names of ciphers supported by the server
|
||||||
|
|
||||||
local seen = {}
|
local seen = {}
|
||||||
local available_ciphers = {}
|
local available_ciphers = {}
|
||||||
local idx = 0;
|
local idx = 0;
|
||||||
|
|
||||||
local ssl_ciphers = {
|
local ssl_ciphers = {
|
||||||
-- (cut down) table of codes with their corresponding ciphers.
|
-- (cut down) table of codes with their corresponding ciphers.
|
||||||
-- inspired by Wireshark's 'epan/dissectors/packet-ssl-utils.h'
|
-- inspired by Wireshark's 'epan/dissectors/packet-ssl-utils.h'
|
||||||
[0x010080] = "SSL2_RC4_128_WITH_MD5",
|
[0x010080] = "SSL2_RC4_128_WITH_MD5",
|
||||||
[0x020080] = "SSL2_RC4_128_EXPORT40_WITH_MD5",
|
[0x020080] = "SSL2_RC4_128_EXPORT40_WITH_MD5",
|
||||||
[0x030080] = "SSL2_RC2_CBC_128_CBC_WITH_MD5",
|
[0x030080] = "SSL2_RC2_CBC_128_CBC_WITH_MD5",
|
||||||
@@ -79,7 +79,7 @@ local ciphers = function(cipher_list, len)
|
|||||||
};
|
};
|
||||||
|
|
||||||
if (len == 0) then return "none"; end
|
if (len == 0) then return "none"; end
|
||||||
-- something's got broken along the way if these aren't equal
|
-- something's got broken along the way if these aren't equal
|
||||||
if (len ~= #cipher_list) then
|
if (len ~= #cipher_list) then
|
||||||
return nil
|
return nil
|
||||||
end
|
end
|
||||||
@@ -105,7 +105,7 @@ end
|
|||||||
|
|
||||||
local give_n_bytes = function(idx, n, str)
|
local give_n_bytes = function(idx, n, str)
|
||||||
|
|
||||||
-- returns the next n bytes of a string
|
-- returns the next n bytes of a string
|
||||||
|
|
||||||
if (idx + (n - 1) > #str) then
|
if (idx + (n - 1) > #str) then
|
||||||
return (idx + n), string.rep(string.char(0x00), n);
|
return (idx + n), string.rep(string.char(0x00), n);
|
||||||
@@ -142,8 +142,8 @@ action = function(host, port)
|
|||||||
local cipher_list;
|
local cipher_list;
|
||||||
local connection_ID;
|
local connection_ID;
|
||||||
|
|
||||||
-- build client hello packet (contents inspired by
|
-- build client hello packet (contents inspired by
|
||||||
-- http://mail.nessus.org/pipermail/plugins-writers/2004-October/msg00041.html )
|
-- http://mail.nessus.org/pipermail/plugins-writers/2004-October/msg00041.html )
|
||||||
local t = {};
|
local t = {};
|
||||||
table.insert(t, string.char(0x80, 0x31));
|
table.insert(t, string.char(0x80, 0x31));
|
||||||
table.insert(t, string.char(0x01));
|
table.insert(t, string.char(0x01));
|
||||||
@@ -177,15 +177,15 @@ action = function(host, port)
|
|||||||
|
|
||||||
server_hello_len = string.sub(server_hello, 1, 2);
|
server_hello_len = string.sub(server_hello, 1, 2);
|
||||||
server_hello_len = hex2dec(server_hello_len);
|
server_hello_len = hex2dec(server_hello_len);
|
||||||
-- length record doesn't include its own length, and is "broken".
|
-- length record doesn't include its own length, and is "broken".
|
||||||
server_hello_len = server_hello_len - (128 * 256) + 2;
|
server_hello_len = server_hello_len - (128 * 256) + 2;
|
||||||
|
|
||||||
-- the hello needs to be at least 13 bytes long to be of any use
|
-- the hello needs to be at least 13 bytes long to be of any use
|
||||||
if (server_hello_len < 13) then
|
if (server_hello_len < 13) then
|
||||||
socket:close();
|
socket:close();
|
||||||
return;
|
return;
|
||||||
end
|
end
|
||||||
--try to get entire hello, if we don't already
|
--try to get entire hello, if we don't already
|
||||||
if (#server_hello < server_hello_len) then
|
if (#server_hello < server_hello_len) then
|
||||||
status, tmp = socket:receive_bytes(server_hello_len - #server_hello);
|
status, tmp = socket:receive_bytes(server_hello_len - #server_hello);
|
||||||
|
|
||||||
@@ -199,7 +199,7 @@ action = function(host, port)
|
|||||||
|
|
||||||
socket:close();
|
socket:close();
|
||||||
|
|
||||||
-- split up server hello into components
|
-- split up server hello into components
|
||||||
idx, message_type = give_n_bytes(idx, 1, server_hello);
|
idx, message_type = give_n_bytes(idx, 1, server_hello);
|
||||||
idx, SID_hit = give_n_bytes(idx, 1, server_hello);
|
idx, SID_hit = give_n_bytes(idx, 1, server_hello);
|
||||||
idx, certificate_type = give_n_bytes(idx, 1, server_hello);
|
idx, certificate_type = give_n_bytes(idx, 1, server_hello);
|
||||||
@@ -214,20 +214,20 @@ action = function(host, port)
|
|||||||
idx, cipher_list = give_n_bytes(idx, ciphers_len, server_hello);
|
idx, cipher_list = give_n_bytes(idx, ciphers_len, server_hello);
|
||||||
idx, connection_ID = give_n_bytes(idx, connection_ID_len, server_hello);
|
idx, connection_ID = give_n_bytes(idx, connection_ID_len, server_hello);
|
||||||
|
|
||||||
-- some sanity checks:
|
-- some sanity checks:
|
||||||
-- is response a server hello?
|
-- is response a server hello?
|
||||||
if (message_type ~= string.char(0x04)) then
|
if (message_type ~= string.char(0x04)) then
|
||||||
return;
|
return;
|
||||||
end
|
end
|
||||||
-- is certificate in X.509 format?
|
-- is certificate in X.509 format?
|
||||||
if (certificate_type ~= string.char(0x01)) then
|
if (certificate_type ~= string.char(0x01)) then
|
||||||
return;
|
return;
|
||||||
end
|
end
|
||||||
|
|
||||||
-- get a list of ciphers offered
|
-- get a list of ciphers offered
|
||||||
available_ciphers = ciphers(cipher_list, ciphers_len);
|
available_ciphers = ciphers(cipher_list, ciphers_len);
|
||||||
|
|
||||||
-- actually run some tests:
|
-- actually run some tests:
|
||||||
local o = stdnse.output_table()
|
local o = stdnse.output_table()
|
||||||
if (ssl_version == string.char(0x00, 0x02)) then
|
if (ssl_version == string.char(0x00, 0x02)) then
|
||||||
table.insert(o, "SSLv2 supported")
|
table.insert(o, "SSLv2 supported")
|
||||||
|
|||||||
@@ -87,8 +87,8 @@ local function single_interface_broadcast(if_nfo, results)
|
|||||||
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
||||||
local dst_ip6 = packet.ip6tobin("ff02::1")
|
local dst_ip6 = packet.ip6tobin("ff02::1")
|
||||||
|
|
||||||
----------------------------------------------------------------------------
|
----------------------------------------------------------------------------
|
||||||
--Multicast invalid destination exheader probe
|
--Multicast invalid destination exheader probe
|
||||||
|
|
||||||
local dnet = nmap.new_dnet()
|
local dnet = nmap.new_dnet()
|
||||||
local pcap = nmap.new_socket()
|
local pcap = nmap.new_socket()
|
||||||
|
|||||||
@@ -129,8 +129,8 @@ local function single_interface_broadcast(if_nfo, results)
|
|||||||
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
||||||
local dst_ip6 = packet.ip6tobin("ff02::1")
|
local dst_ip6 = packet.ip6tobin("ff02::1")
|
||||||
|
|
||||||
----------------------------------------------------------------------------
|
----------------------------------------------------------------------------
|
||||||
--SLAAC-based host discovery probe
|
--SLAAC-based host discovery probe
|
||||||
|
|
||||||
local dnet = nmap.new_dnet()
|
local dnet = nmap.new_dnet()
|
||||||
local pcap = nmap.new_socket()
|
local pcap = nmap.new_socket()
|
||||||
|
|||||||
Reference in New Issue
Block a user