PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-01-01 04:19:02 +00:00
Code Issues Projects Releases Wiki Activity

Change sslstrip service probe match to softmatch.

Browse Source 
SSLStrip is not the only service to respond to the GenericLines probe
with the "HTTP 400 Bad Request" match: TwistedWeb and at least one
home router does too.  The softmatch will allow these other services
to be queried by more specific probes.

It would obviously be better to find a better way of matching SSLStrip
and this softmatch may yet be deleted if it causes services to be
erroneously labelled as sslstrip where there is no better match.

See thread at http://seclists.org/nmap-dev/2014/q1/337
This commit is contained in:
jah
2015-05-14 15:17:33 +00:00
parent ed9e9eb154
commit d6ff72d9a3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nmap-service-probes
View File

@@ -5024,7 +5024,7 @@ match http-proxy m|^<HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD>\n<BODY
match http-proxy m|^HTTP/1\.[01] .*\r\nServer: Mikrotik HttpProxy\r\n|s p/MikroTik http proxy/
# Actually got over 600 spaces at the end of this, but that could be a fluke?
match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-Type: text/html\r\nPragma: no-cache\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\n\r\n<html><body>Invalid request<P><HR><i>This message was created by Kerio Control Proxy</i></body></html> {100}| p/Kerio Control http proxy/ cpe:/a:kerio:control/
match http-proxy m|^HTTP/1\.1 400 Bad Request\r\n\r\n$| p/sslstrip/
softmatch http-proxy m|^HTTP/1\.1 400 Bad Request\r\n\r\n$| p/sslstrip/
match hp-problemdiagnostics m|^<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<NETPATH_PROBE version=\"[\w._-]+\">\n\t<SOURCE device_type=\"HOST\">\n\t\t<DNS>([\w._-]+)</DNS>\n\t\t<IP_OUT>[\d.]+</IP_OUT>\n\t</SOURCE>\n\t<DESTINATION name=\"\" arguments=\"\">\n\t\t<ERROR code=\"3\">\n\t\t\t<MESSAGE>No destination specified</MESSAGE>\n\t\t</ERROR>\n\t</DESTINATION>\n</NETPATH_PROBE>\n\n$| p/HP Problem Diagnostics/ h/$1/