mirror of
https://github.com/nmap/nmap.git
synced 2025-12-17 05:09:00 +00:00
-updates markup to extract domains ( it was broken )
-adds xml structured output -updates documentation and adds @xmloutput tag
This commit is contained in:
@@ -27,19 +27,37 @@ This script was formerly (until April 2012) known as hostmap.nse.
|
|||||||
--
|
--
|
||||||
-- @output
|
-- @output
|
||||||
-- Host script results:
|
-- Host script results:
|
||||||
-- | hostmap-bfk: Saved to hostmap-nmap.org
|
-- | hostmap-bfk:
|
||||||
-- | insecure.org
|
-- | hosts:
|
||||||
-- | 74.207.254.18
|
-- | insecure.org
|
||||||
-- | web.insecure.org
|
-- | 173.255.243.189
|
||||||
-- | download.insecure.org
|
-- | images.insecure.org
|
||||||
-- | images.insecure.org
|
-- | www.insecure.org
|
||||||
-- | www.insecure.org
|
-- | nmap.org
|
||||||
-- | nmap.org
|
-- | 189.243.255.173.in-addr.arpa
|
||||||
-- | www.nmap.org
|
-- | mail.nmap.org
|
||||||
-- | sectools.org
|
-- | svn.nmap.org
|
||||||
-- | mirror.sectools.org
|
-- | www.nmap.org
|
||||||
-- | www.sectools.org
|
-- | sectools.org
|
||||||
-- |_seclists.org
|
-- | seclists.org
|
||||||
|
-- |_ li253-189.members.linode.com
|
||||||
|
--
|
||||||
|
-- @xmloutput
|
||||||
|
-- <table key="hosts">
|
||||||
|
-- <elem>insecure.org</elem>
|
||||||
|
-- <elem>173.255.243.189</elem>
|
||||||
|
-- <elem>images.insecure.org</elem>
|
||||||
|
-- <elem>www.insecure.org</elem>
|
||||||
|
-- <elem>nmap.org</elem>
|
||||||
|
-- <elem>189.243.255.173.in-addr.arpa</elem>
|
||||||
|
-- <elem>mail.nmap.org</elem>
|
||||||
|
-- <elem>svn.nmap.org</elem>
|
||||||
|
-- <elem>www.nmap.org</elem>
|
||||||
|
-- <elem>sectools.org</elem>
|
||||||
|
-- <elem>seclists.org</elem>
|
||||||
|
-- <elem>li253-189.members.linode.com</elem>
|
||||||
|
-- </table>
|
||||||
|
---
|
||||||
|
|
||||||
author = "Ange Gutek"
|
author = "Ange Gutek"
|
||||||
|
|
||||||
@@ -59,52 +77,45 @@ end
|
|||||||
action = function(host)
|
action = function(host)
|
||||||
local query = "/bfk_dnslogger.html?query=" .. host.ip
|
local query = "/bfk_dnslogger.html?query=" .. host.ip
|
||||||
local response
|
local response
|
||||||
|
local output_tab = stdnse.output_table()
|
||||||
response = http.get(HOSTMAP_SERVER, 80, query)
|
response = http.get(HOSTMAP_SERVER, 80, query)
|
||||||
if not response.status then
|
if not response.status then
|
||||||
return string.format("Error: could not GET http://%s%s", HOSTMAP_SERVER, query)
|
stdnse.print_debug(1, "Error: could not GET http://%s%s", HOSTMAP_SERVER, query)
|
||||||
|
return nil
|
||||||
end
|
end
|
||||||
|
|
||||||
local hostnames = {}
|
local hostnames = {}
|
||||||
for entry in string.gmatch(response.body, "#result\">([^<]-)</a>") do
|
local hosts_log = {}
|
||||||
|
for entry in string.gmatch(response.body, "#result\" rel=\"nofollow\">(.-)</a></tt>") do
|
||||||
if not hostnames[entry] then
|
if not hostnames[entry] then
|
||||||
if target.ALLOW_NEW_TARGETS then
|
if target.ALLOW_NEW_TARGETS then
|
||||||
local status, err = target.add(entry)
|
local status, err = target.add(entry)
|
||||||
end
|
end
|
||||||
hostnames[entry] = true
|
hostnames[entry] = true
|
||||||
if string.match(entry, "%d+%.%d+%.%d+%.%d+") or dns.query(entry) then
|
hosts_log[#hosts_log + 1] = entry
|
||||||
hostnames[#hostnames + 1] = entry
|
|
||||||
else
|
|
||||||
hostnames[#hostnames + 1] = entry .. " (cannot resolve)"
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
if #hostnames == 0 then
|
if #hosts_log == 0 then
|
||||||
if not string.find(response.body, "<p>The server returned no hits.</p>") then
|
if not string.find(response.body, "<p>The server returned no hits.</p>") then
|
||||||
return "Error: found no hostnames but not the marker for \"no hostnames found\" (pattern error?)"
|
stdnse.print_debug(1,"Error: found no hostnames but not the marker for \"no hostnames found\" (pattern error?)")
|
||||||
end
|
end
|
||||||
return
|
return nil
|
||||||
end
|
end
|
||||||
|
output_tab.hosts = hosts_log
|
||||||
local hostnames_str = stdnse.strjoin("\n", hostnames)
|
local hostnames_str = stdnse.strjoin("\n", hostnames)
|
||||||
local output_str
|
|
||||||
|
|
||||||
local filename_prefix = stdnse.get_script_args("hostmap-bfk.prefix")
|
local filename_prefix = stdnse.get_script_args("hostmap-bfk.prefix")
|
||||||
if filename_prefix then
|
if filename_prefix then
|
||||||
local filename = filename_prefix .. filename_escape(host.targetname or host.ip)
|
local filename = filename_prefix .. filename_escape(host.targetname or host.ip)
|
||||||
local status, err = write_file(filename, hostnames_str .. "\n")
|
local status, err = write_file(filename, hostnames_str .. "\n")
|
||||||
if status then
|
if status then
|
||||||
output_str = string.format("Saved to %s\n", filename)
|
output_tab.filename = filename
|
||||||
else
|
else
|
||||||
output_str = string.format("Error saving to %s: %s\n", filename, err)
|
stdnse.print_debug(1,"Error saving to %s: %s\n", filename, err)
|
||||||
end
|
end
|
||||||
else
|
|
||||||
output_str = "\n"
|
|
||||||
end
|
end
|
||||||
output_str = output_str .. stdnse.strjoin("\n", hostnames)
|
|
||||||
|
|
||||||
return output_str
|
return output_tab
|
||||||
end
|
end
|
||||||
|
|
||||||
-- Escape some potentially unsafe characters in a string meant to be a filename.
|
-- Escape some potentially unsafe characters in a string meant to be a filename.
|
||||||
|
|||||||
Reference in New Issue
Block a user