PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 12:41:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix line wrapping

Browse Source
This commit is contained in:
nnposter
2020-08-30 22:59:57 +00:00
parent c3431b9025
commit fd16f90242
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
scripts/http-shellshock.nse
View File

@@ -6,14 +6,15 @@ local vulns = require "vulns"
local rand = require "rand"
description = [[
Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications.
Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and
CVE-2014-7169) in web applications.
To detect this vulnerability the script executes a command that prints a
random string and then attempts to find it inside the response body. Web apps that
don't print back information won't be detected with this method.
To detect this vulnerability the script executes a command that prints a random
string and then attempts to find it inside the response body. Web apps that
don't print back information won't be detected with this method.
By default the script injects the payload in the HTTP headers User-Agent,
Cookie, Referer and also uses the payload as the header name.
Cookie, and Referer.
Vulnerability originally discovered by Stephane Chazelas.
@@ -118,8 +119,9 @@ action = function(host, port)
title = 'HTTP Shellshock vulnerability',
state = vulns.STATE.NOT_VULN,
description = [[
This web application might be affected by the vulnerability known as Shellshock. It seems the server
is executing commands injected via malicious HTTP headers.
This web application might be affected by the vulnerability known
as Shellshock. It seems the server is executing commands injected
via malicious HTTP headers.
]],
IDS = {CVE = 'CVE-2014-6271'},
references = {