diff --git a/scripts/http-cookie-flags.nse b/scripts/http-cookie-flags.nse
index 7d8ca57bb..84872fd40 100644
--- a/scripts/http-cookie-flags.nse
+++ b/scripts/http-cookie-flags.nse
@@ -55,6 +55,7 @@ by it will be checked in addition to the root.
--
--
-- @see http-enum.nse
+-- @see http-security-headers.nse
categories = { "default", "safe", "vuln" }
author = "Steve Benson"
diff --git a/scripts/http-headers.nse b/scripts/http-headers.nse
index e6eb9aa33..60890fed2 100644
--- a/scripts/http-headers.nse
+++ b/scripts/http-headers.nse
@@ -24,6 +24,8 @@ Performs a HEAD request for the root folder ("/") of a web server and displays t
--
--@args path The path to request, such as /index.php. Default /.
--@args useget Set to force GET requests instead of HEAD.
+--
+--@see http-security-headers.nse
author = "Ron Bowes"
diff --git a/scripts/smb-double-pulsar-backdoor.nse b/scripts/smb-double-pulsar-backdoor.nse
index a7df03894..819fe0a57 100644
--- a/scripts/smb-double-pulsar-backdoor.nse
+++ b/scripts/smb-double-pulsar-backdoor.nse
@@ -14,6 +14,8 @@ https://github.com/countercept/doublepulsar-detection-script
---
-- @usage nmap -p 445 --script=smb-double-pulsar-backdoor
--
+-- @see smb-vuln-ms17-010.nse
+--
-- @output
-- | smb-double-pulsar-backdoor:
-- | VULNERABLE:
diff --git a/scripts/smb-vuln-ms17-010.nse b/scripts/smb-vuln-ms17-010.nse
index b9b22c239..4a736b520 100644
--- a/scripts/smb-vuln-ms17-010.nse
+++ b/scripts/smb-vuln-ms17-010.nse
@@ -5,7 +5,7 @@ local string = require "string"
description = [[
Attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code
- execution vulnerability (ms17-010).
+ execution vulnerability (ms17-010, a.k.a. EternalBlue).
The script connects to the $IPC tree, executes a transaction on FID 0 and
checks if the error "STATUS_INSUFF_SERVER_RESOURCES" is returned to
@@ -18,7 +18,7 @@ References:
* https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
* https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
* https://msdn.microsoft.com/en-us/library/ee441489.aspx
-* https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb
+* https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb
* https://github.com/cldrn/nmap-nse-scripts/wiki/Notes-about-smb-vuln-ms17-010
]]
@@ -26,9 +26,11 @@ References:
-- @usage nmap -p445 --script smb-vuln-ms17-010
-- @usage nmap -p445 --script vuln
--
+-- @see smb-double-pulsar-backdoor.nse
+--
-- @output
-- Host script results:
--- | smb-vuln-ms17-010:
+-- | smb-vuln-ms17-010:
-- | VULNERABLE:
-- | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
-- | State: VULNERABLE
@@ -36,7 +38,7 @@ References:
-- | Risk factor: HIGH
-- | A critical remote code execution vulnerability exists in Microsoft SMBv1
-- | servers (ms17-010).
--- |
+-- |
-- | Disclosure date: 2017-03-14
-- | References:
-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
@@ -114,9 +116,9 @@ local function check_ms17010(host, port, sharename)
0x0, --
0x0700, -- BCC (Length of "\PIPE\")
0x5c50, -- \P
- 0x4950, -- IP
+ 0x4950, -- IP
0x455c -- E\
- )
+ )
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION")
result, err = smb.smb_send(smbstate, smb_header, smb_params, '', overrides)
if(result == false) then
@@ -130,12 +132,12 @@ local function check_ms17010(host, port, sharename)
stdnse.debug1("Valid SMB_COM_TRANSACTION response received")
--STATUS_INSUFF_SERVER_RESOURCES indicate that the machine is not patched
- if err == 0xc0000205 then
+ if err == 0xc0000205 then
stdnse.debug1("STATUS_INSUFF_SERVER_RESOURCES response received")
return true
elseif err == 0xc0000022 then
stdnse.debug1("STATUS_ACCESS_DENIED response received. This system is likely patched.")
- return false, "This system is patched."
+ return false, "This system is patched."
elseif err == 0xc0000008 then
stdnse.debug1("STATUS_INVALID_HANDLE response received. This system is likely patched.")
return false, "This system is patched."
@@ -157,10 +159,10 @@ action = function(host,port)
description = [[
A critical remote code execution vulnerability exists in Microsoft SMBv1
servers (ms17-010).
-]],
+ ]],
references = {
- 'https://technet.microsoft.com/en-us/library/security/ms17-010.aspx',
- 'https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/'
+ 'https://technet.microsoft.com/en-us/library/security/ms17-010.aspx',
+ 'https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/'
},
dates = {
disclosure = {year = '2017', month = '03', day = '14'},