PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-25 17:09:02 +00:00
Code Issues Projects Releases Wiki Activity

Use http.parse_redirect and allow arbitrary verbs in http-form-brute

Browse Source 
There's no reason we can't use other verbs besides GET and POST. Other
verbs are handled like GET requests (parameters in the URI string). Any
redirect responses will be followed with GET requests, though.
This commit is contained in:
dmiller
2014-09-17 21:57:59 +00:00
parent 440ed59396
commit d518e2dbcb
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
scripts/http-form-brute.nse
View File

@@ -154,18 +154,17 @@ Driver = {
sendLogin = function( host, port, path, method, params )
local response
local uri = path
if method == "POST" then
response = http.post(host, port, path, {no_cache = true}, nil, params)
else
local uri = path
.. (path:find("?", 1, true) and "&" or "?")
.. url.build_query(params)
response = http.get(host, port, uri, {no_cache = true})
uri = path .. (path:find("?", 1, true) and "&" or "?")
.. url.build_query(params)
response = http.generic_request(host, port, method, uri, {no_cache = true})
end
local status = ( response and tonumber(response.status) ) or 0
if ( status > 300 and status < 400 ) then
local new_path = url.absolute(path, response.header.location)
response = http.get( host, port, new_path, { no_cache = true } )
local u = http.parse_redirect(host, port, uri, response)
if u then
response = http.get( u.host, u.port, u.path, {no_cache = true} )
end
return response
end,
@@ -202,7 +201,7 @@ action = function( host, port )
method=method:upper()
if not (method=="GET" or method=="POST") then
return stdnse.format_output(false, "Invalid HTTP method: " .. method)
stdnse.debug1("Using non-standard HTTP method: %s", method)
end
-- if now fields were given attempt to autodetect