google.com can resolve to a different set of addresses each time you
resolve it, which makes the addrset tests fail. Use scanme.nmap.org
instead, since (at least for now) that has only one address assigned.
This one also fixes format string bugs:
stdnse.print_debug(foo) --> stdnse.debug1("%s", foo)
$ sed -i 's/stdnse.print_debug( *\([a-zA-Z0-9][a-zA-Z0-9_]*\) *)/stdnse.debug1("%s", \1)/' *.nse
$ sed -i 's/stdnse.print_debug( *\([0-9]*\) *, *\([a-zA-Z0-9][a-zA-Z0-9_]*\) *)/stdnse.debug\1("%s", \2)/' *.nse
$ sed -i 's/stdnse.print_debug("[-a-z0-9]*:\s*\([^"]*\)"/stdnse.debug1("\1"/' *.nse
$ sed -i 's/stdnse.print_debug(\([0-9]*\),\s*"[-a-z0-9]*:\s*\([^"]*\)"/stdnse.debug\1("\2"/' *.nse
Except:
o eap-info.nse
o oracle-brute.nse
Modified:
o couchdb-databases.nse
o couchdb-stats.nse
o http-open-redirect.nse
Reported here: http://seclists.org/nmap-dev/2014/q3/137
Hostgroups should have a common outgoing interface and source address,
determined by target_needs_new_hostgroup. Source address for raw IP
probes (sendIPScanProbe) is taken from the list of decoys (o.decoys),
which always at least contains a "self" element at index o.decoyturn.
This element was not being set while filling a hostgroup for massping,
so it was using whatever the value from the last hostgroup had. This
only matters when mixing targets that require different source
addresses, as demonstrated by scanning localhost and some other address.
branch-reset patterns (?|...) were introduced in Perl 5.10.0, but some
folks complained when their older PCRE libs crashed on this line.
This changes the use into a single outer capture, then uses the $P()
helper function to strip out the unprintable length bytes.
This was a case where order of arguments affected the outcome: if -PE
came before -Pn, then -Pn took precedence. Otherwise, -PE took
precedence (except that o.pingtype would also contain PINGTYPE_NONE...
not sure how that affected things). This cleans things up by letting
PINGTYPE_NONE be OR'd into o.opingtype, then checking for it after all
options have been processed and clearing out the other types if it is
found.
The TLS standard (TLS 1.2, but also probably the others) states:
> In the absence of an application profile standard specifying
> otherwise, a TLS-compliant application MUST implement the cipher
> suite TLS_RSA_WITH_AES_128_CBC_SHA
This was causing some problems with some implementations (See
http://seclists.org/nmap-dev/2014/q3/119)
