mirror of
https://github.com/nmap/nmap.git
synced 2025-12-15 12:19:02 +00:00
Re-indent some more scripts. Whitespace-only commit
https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
@@ -145,8 +145,8 @@ action = function(host, port)
|
||||
Directory traversal vulnerability in AFP Server in Apple Mac OS X before
|
||||
10.6.3 allows remote attackers to list a share root's parent directory.]],
|
||||
references = {
|
||||
'http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap',
|
||||
'http://support.apple.com/kb/HT1222',
|
||||
'http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap',
|
||||
'http://support.apple.com/kb/HT1222',
|
||||
},
|
||||
dates = {
|
||||
disclosure = {year = '2010', month = '03', day = '29'},
|
||||
|
||||
@@ -80,7 +80,7 @@ payloads = {
|
||||
{ vector = 'ghz>hzx', description = "Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability." },
|
||||
{ vector = 'hzx"zxc', description = "Unfiltered \" (double quotation mark). An indication of potential XSS vulnerability." },
|
||||
{ vector = 'zxc\'xcv', description = "Unfiltered ' (apostrophe). An indication of potential XSS vulnerability." },
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
-- Create customized requests for all of our payloads.
|
||||
|
||||
@@ -168,7 +168,7 @@ local function split(str, sep)
|
||||
local pattern = string.format("([^%s]+)", sep)
|
||||
str:gsub(pattern, function(c) fields[#fields+1] = c end)
|
||||
return fields
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
--This is a customData formatter. In some cases, the RMI library finds 'custom data' which belongs to an object.
|
||||
|
||||
@@ -138,7 +138,7 @@ local function get_info_registry(host)
|
||||
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
|
||||
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
|
||||
end
|
||||
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
||||
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
||||
|
||||
-- TODO: Known DLLs?
|
||||
|
||||
|
||||
@@ -59,15 +59,15 @@ end
|
||||
|
||||
local ciphers = function(cipher_list, len)
|
||||
|
||||
-- returns names of ciphers supported by the server
|
||||
-- returns names of ciphers supported by the server
|
||||
|
||||
local seen = {}
|
||||
local available_ciphers = {}
|
||||
local idx = 0;
|
||||
|
||||
local ssl_ciphers = {
|
||||
-- (cut down) table of codes with their corresponding ciphers.
|
||||
-- inspired by Wireshark's 'epan/dissectors/packet-ssl-utils.h'
|
||||
-- (cut down) table of codes with their corresponding ciphers.
|
||||
-- inspired by Wireshark's 'epan/dissectors/packet-ssl-utils.h'
|
||||
[0x010080] = "SSL2_RC4_128_WITH_MD5",
|
||||
[0x020080] = "SSL2_RC4_128_EXPORT40_WITH_MD5",
|
||||
[0x030080] = "SSL2_RC2_CBC_128_CBC_WITH_MD5",
|
||||
@@ -79,7 +79,7 @@ local ciphers = function(cipher_list, len)
|
||||
};
|
||||
|
||||
if (len == 0) then return "none"; end
|
||||
-- something's got broken along the way if these aren't equal
|
||||
-- something's got broken along the way if these aren't equal
|
||||
if (len ~= #cipher_list) then
|
||||
return nil
|
||||
end
|
||||
@@ -105,7 +105,7 @@ end
|
||||
|
||||
local give_n_bytes = function(idx, n, str)
|
||||
|
||||
-- returns the next n bytes of a string
|
||||
-- returns the next n bytes of a string
|
||||
|
||||
if (idx + (n - 1) > #str) then
|
||||
return (idx + n), string.rep(string.char(0x00), n);
|
||||
@@ -142,8 +142,8 @@ action = function(host, port)
|
||||
local cipher_list;
|
||||
local connection_ID;
|
||||
|
||||
-- build client hello packet (contents inspired by
|
||||
-- http://mail.nessus.org/pipermail/plugins-writers/2004-October/msg00041.html )
|
||||
-- build client hello packet (contents inspired by
|
||||
-- http://mail.nessus.org/pipermail/plugins-writers/2004-October/msg00041.html )
|
||||
local t = {};
|
||||
table.insert(t, string.char(0x80, 0x31));
|
||||
table.insert(t, string.char(0x01));
|
||||
@@ -177,15 +177,15 @@ action = function(host, port)
|
||||
|
||||
server_hello_len = string.sub(server_hello, 1, 2);
|
||||
server_hello_len = hex2dec(server_hello_len);
|
||||
-- length record doesn't include its own length, and is "broken".
|
||||
-- length record doesn't include its own length, and is "broken".
|
||||
server_hello_len = server_hello_len - (128 * 256) + 2;
|
||||
|
||||
-- the hello needs to be at least 13 bytes long to be of any use
|
||||
-- the hello needs to be at least 13 bytes long to be of any use
|
||||
if (server_hello_len < 13) then
|
||||
socket:close();
|
||||
return;
|
||||
end
|
||||
--try to get entire hello, if we don't already
|
||||
--try to get entire hello, if we don't already
|
||||
if (#server_hello < server_hello_len) then
|
||||
status, tmp = socket:receive_bytes(server_hello_len - #server_hello);
|
||||
|
||||
@@ -199,7 +199,7 @@ action = function(host, port)
|
||||
|
||||
socket:close();
|
||||
|
||||
-- split up server hello into components
|
||||
-- split up server hello into components
|
||||
idx, message_type = give_n_bytes(idx, 1, server_hello);
|
||||
idx, SID_hit = give_n_bytes(idx, 1, server_hello);
|
||||
idx, certificate_type = give_n_bytes(idx, 1, server_hello);
|
||||
@@ -214,20 +214,20 @@ action = function(host, port)
|
||||
idx, cipher_list = give_n_bytes(idx, ciphers_len, server_hello);
|
||||
idx, connection_ID = give_n_bytes(idx, connection_ID_len, server_hello);
|
||||
|
||||
-- some sanity checks:
|
||||
-- is response a server hello?
|
||||
-- some sanity checks:
|
||||
-- is response a server hello?
|
||||
if (message_type ~= string.char(0x04)) then
|
||||
return;
|
||||
end
|
||||
-- is certificate in X.509 format?
|
||||
-- is certificate in X.509 format?
|
||||
if (certificate_type ~= string.char(0x01)) then
|
||||
return;
|
||||
end
|
||||
|
||||
-- get a list of ciphers offered
|
||||
-- get a list of ciphers offered
|
||||
available_ciphers = ciphers(cipher_list, ciphers_len);
|
||||
|
||||
-- actually run some tests:
|
||||
-- actually run some tests:
|
||||
local o = stdnse.output_table()
|
||||
if (ssl_version == string.char(0x00, 0x02)) then
|
||||
table.insert(o, "SSLv2 supported")
|
||||
|
||||
@@ -87,8 +87,8 @@ local function single_interface_broadcast(if_nfo, results)
|
||||
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
||||
local dst_ip6 = packet.ip6tobin("ff02::1")
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
--Multicast invalid destination exheader probe
|
||||
----------------------------------------------------------------------------
|
||||
--Multicast invalid destination exheader probe
|
||||
|
||||
local dnet = nmap.new_dnet()
|
||||
local pcap = nmap.new_socket()
|
||||
|
||||
@@ -129,8 +129,8 @@ local function single_interface_broadcast(if_nfo, results)
|
||||
local dst_mac = packet.mactobin("33:33:00:00:00:01")
|
||||
local dst_ip6 = packet.ip6tobin("ff02::1")
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
--SLAAC-based host discovery probe
|
||||
----------------------------------------------------------------------------
|
||||
--SLAAC-based host discovery probe
|
||||
|
||||
local dnet = nmap.new_dnet()
|
||||
local pcap = nmap.new_socket()
|
||||
|
||||
Reference in New Issue
Block a user