nnposter
3af4a0c20c
Adds a fingerprint for Schneider Modicon Web Server
2016-08-30 21:09:24 +00:00
nnposter
24e6547a08
Adds a fingerprint for Zabbix monitoring
2016-08-30 21:07:49 +00:00
nnposter
3419a71b24
Adds a fingerprint for HP Storage Management Utility
2016-08-30 21:06:02 +00:00
nnposter
3ea1cdf460
Reduces false-positives by treating 404 as a failed authentication
2016-08-30 16:12:30 +00:00
nnposter
020980bcba
Adds a fingerprint for Dell iDRAC6 remote console to script http-default-accounts
2016-08-22 13:43:53 +00:00
nnposter
c23e8bae3e
Adds a fingerprint for Lantronix ThinWeb Manager to script http-default-accounts
2016-08-22 13:41:01 +00:00
nnposter
76760b0c8d
Adds a fingerprint for Motorola AP-7532 to script http-default-accounts
2016-08-22 13:35:18 +00:00
nnposter
47d84ec60f
Tightens target_check in the fingerprint for BeEF
2016-08-20 02:15:02 +00:00
nnposter
0303ef5b59
Adds a few trivial improvements to the http-default-accounts fingerprints
2016-08-19 19:14:51 +00:00
nnposter
c3ab8da378
Updates target_check in the fingerprint for Zebra printers to accommodate older versions
2016-08-19 19:07:44 +00:00
nnposter
034ba003ec
Adds Aironet credentials to the fingerprint for Cisco IOS
2016-08-19 18:57:52 +00:00
nnposter
cc996985f8
Adds a more meaningful target_check to the fingerprint for Apache Axis2
2016-08-19 18:50:23 +00:00
nnposter
0aefe63c2b
Generalizes the fingerprint for Adobe LiveCycle Management Console
2016-08-19 18:33:57 +00:00
nnposter
37a9142101
Updates the listed http-default-accounts fingerprints to take advantage of
...
probe result sharing across fingerprints. (This feature has been implemented
in r36134 and described in issue 516.)
- Cacti
- Cisco IOS
- Cisco WAP200
- Cisco WAP55AG
- ASUS RT-N10U
- Motorola RF Switch
- Nortel VPN Router
- F5 BIG-IP
- Zebra Printer
- RICOH Web Image Monitor
- Lantronix SLC
2016-08-19 18:06:10 +00:00
nnposter
7d9994597e
Updates auth realm extraction pattern to accommodate extraneous spaces in the HTTP response header
2016-08-16 02:00:17 +00:00
nnposter
2804d04d36
Fixes Xplico fingerprint to account for non-default base path
2016-08-15 15:56:54 +00:00
dmiller
b5f5690bb0
New default accounts from nnposter. Closes #301
2016-02-14 14:42:18 +00:00
dmiller
6ba9936d24
NSE support for Adobe LiveCycle
...
http-fingerprints and default account additions by rvrsh3ll.
Closes #61
2015-02-20 15:54:13 +00:00
dmiller
ca3d838b1b
Fix some globals in nselib/data/http-*.lua
2015-02-20 15:54:12 +00:00
paulino
588d744bd6
Adds Zebra printer fingerprints to http-default-accounts
2015-02-17 23:38:40 +00:00
paulino
97c56e3e57
Adds fingerprints for ASUS RT-N10U and motorola RF switch
2014-10-18 04:09:05 +00:00
paulino
64b40b7a93
Adds signature for Lantronix SLC ( http://www.lantronix.com/it-management/console-servers/slc.html ) to http-default-accounts
2014-08-25 01:12:59 +00:00
paulino
34691d779d
* Applies patch to Cacti fingerprint.
...
* Adds Xplico (http://www.xplico.org/ ) fingerprint.
2014-06-11 19:44:24 +00:00
sophron
a673b79aa6
Added an entry to http-default-accounts-fingerprints that detects F5 BIG-IP router. Patch by nnposter.
2014-03-02 17:46:06 +00:00
dmiller
7dd47ec3a3
Re-indent the Lua files in nselib/data/
...
https://secwiki.org/w/Nmap/Code_Standards
2014-02-05 17:58:36 +00:00
dmiller
620f9fdb34
Remove trailing whitespace in lua files
...
Whitespace is not significant, so this should not be a problem.
https://secwiki.org/w/Nmap/Code_Standards
2014-01-23 21:51:58 +00:00
sophron
9561155701
Patch by nnposter that improves performance of http-default-accounts
...
http://seclists.org/nmap-dev/2013/q3/346
For any given fingerprint from http-default-accounts-fingerprints
script http-default-accounts currently tests corresponding default
credentials if at least one of the probe URLs succeeded, namely
returned with status other than 404.
Some web servers, such as Linksys devices, respond with HTTP/401 even
for non-existent URLs. This causes the script to assume that these URLs
do exist and to test the credentials, while ideally they should be
tested only on those servers where they make sense.
The purpose of the attached patches is to reduce unnecessary credential
guessing by implementing a new optional fingerprint element, function
target_check(), which takes some already collected target information,
including a probe URL response, and returns true or false, indicating
whether the credential guessing should be attempted or not.
All of the current fingerprints have been retrofitted with simple
target validations as follows:
* If the fingerprint uses native HTTP authentication, validate that the
target's realm matches the server type.
* If the fingerprint uses form-based authentication, validate that the
probe URL returned with HTTP/200 (as opposed to perhaps HTTP/401).
When testing against the above-mentioned Linksys the difference was
notable: 14 login attempts before the patch versus 1 attempt after the
patch.
This functionality provides opportunity for further improvement by
being able to match page content to differentiate between real HTTP/200
and a custom error page. (As of now the script completely skips targets
that return HTTP/200 for non-existent pages.)
2013-08-18 01:42:48 +00:00
sophron
d93a4a21fe
Replace the concatenation with a more uniform function call.
2013-08-15 17:36:21 +00:00
sophron
4fcbacc49d
Added a fingerprint for Cisco/Linksys WAP55AG accesspoint.
2013-08-09 17:51:07 +00:00
sophron
8572c85d0b
Correctly handle cases where the tested fingerprint path does not end with "/". Patch by nnposter.
2013-07-30 00:03:04 +00:00
sophron
40220702d0
Added Linksys WAP200 to http-default-accounts-fingerprints.
2013-07-29 22:17:52 +00:00
sophron
91858c55d4
Handle 404 responses. Patch by nnposter.
2013-07-29 15:57:34 +00:00
sophron
93accf0619
Handle cases where the HTTP response fails. Patch by nnposter.
2013-07-29 06:14:04 +00:00
david
a58e6d0f33
-Adds digest support to basic login method.
...
-Adds detection entry for Digital Sprite 2 ( Digital recorder )
Originally committed by paulino but recommitted by david after recovery
from backup.
2013-04-12 17:29:26 +00:00
aca
ba5a79acdc
Added few aditional credentials to http-default-accounts fingerprints
2012-06-22 16:06:05 +00:00
batrick
a04314beaa
Add missing requires.
2012-05-29 18:34:34 +00:00
patrik
fccccff960
* bugfixes to several http scripts related to new redirect code in http
...
library
* added option to httpspider that allows passing the redirect_ok closure to
the http library
[Patrik]
2012-02-11 22:37:14 +00:00
paulino
deded46038
Adds apache axis2 login signature.
2011-07-15 23:43:10 +00:00
paulino
84a4bb2506
Added signature of a Cisco router
2011-07-08 18:44:23 +00:00
paulino
e9e4b6d27d
Adds new fingerprint and new login template.
2011-07-04 20:56:06 +00:00
paulino
4f21388faa
Adds http-default-accounts fingerprint database
2011-07-01 21:43:53 +00:00
