From 72544c0b9ea5ef00d8a05045891d9444fd0e48ec Mon Sep 17 00:00:00 2001 From: dmiller Date: Thu, 23 Jul 2026 18:06:50 +0000 Subject: [PATCH] Add 's' service names to portrules --- CHANGELOG | 4 ++++ nselib/ftp.lua | 5 +++++ scripts/amqp-info.nse | 2 +- scripts/coap-resources.nse | 3 +-- scripts/ftp-anon.nse | 3 +-- scripts/ftp-bounce.nse | 3 +-- scripts/ftp-brute.nse | 3 +-- scripts/ftp-libopie.nse | 2 +- scripts/ftp-proftpd-backdoor.nse | 3 +-- scripts/ftp-syst.nse | 3 +-- scripts/ftp-vsftpd-backdoor.nse | 3 +-- scripts/ftp-vuln-cve2010-4221.nse | 3 +-- scripts/http-csrf.nse | 2 +- scripts/http-devframework.nse | 2 +- scripts/http-dombased-xss.nse | 2 +- scripts/http-domino-enum-passwords.nse | 2 +- scripts/http-errors.nse | 2 +- scripts/http-feed.nse | 2 +- scripts/http-fileupload-exploiter.nse | 2 +- scripts/http-form-brute.nse | 2 +- scripts/http-mobileversion-checker.nse | 2 +- scripts/http-qnap-nas-info.nse | 2 +- scripts/http-referer-checker.nse | 2 +- scripts/http-rfi-spider.nse | 2 +- scripts/http-security-headers.nse | 2 +- scripts/http-sitemap-generator.nse | 2 +- scripts/http-sql-injection.nse | 2 +- scripts/http-stored-xss.nse | 2 +- scripts/http-useragent-tester.nse | 2 +- scripts/telnet-brute.nse | 2 +- scripts/telnet-ntlm-info.nse | 4 ++-- 31 files changed, 39 insertions(+), 38 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 7e831d19d..e51549b21 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,9 @@ #Nmap Changelog ($Id$); -*-text-*- +o [NSE][GH#1066] Added service names for SSL-protected services like + amt-soap-https to portrules for several scripts, ensuring they run on these + as well as the standard unencrypted services. + o Audited and converted most instances of strcat, strcpy, and sprintf to use bounded functions instead. diff --git a/nselib/ftp.lua b/nselib/ftp.lua index d3d27b87c..f87add4a3 100644 --- a/nselib/ftp.lua +++ b/nselib/ftp.lua @@ -4,6 +4,7 @@ -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html local comm = require "comm" +local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local table = require "table" @@ -11,6 +12,10 @@ local ipOps = require "ipOps" local nmap = require "nmap" _ENV = stdnse.module("ftp", stdnse.seeall) +--- Portrule for FTP services +-- @class function +portrule = shortport.port_or_service({21, 990}, {"ftp", "ftps"}) + local ERROR_MESSAGES = { ["EOF"] = "connection closed", ["TIMEOUT"] = "connection timeout", diff --git a/scripts/amqp-info.nse b/scripts/amqp-info.nse index d0d299f43..7e2e71d2e 100644 --- a/scripts/amqp-info.nse +++ b/scripts/amqp-info.nse @@ -37,7 +37,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "discovery", "safe", "version"} -portrule = shortport.version_port_or_service(5672, "amqp", "tcp", "open") +portrule = shortport.version_port_or_service(5672, {"amqp", "amqps"}, "tcp", "open") action = function(host, port) local cli = amqp.AMQP:new( host, port ) diff --git a/scripts/coap-resources.nse b/scripts/coap-resources.nse index 9009def6d..3588bfeb5 100644 --- a/scripts/coap-resources.nse +++ b/scripts/coap-resources.nse @@ -73,8 +73,7 @@ author = "Mak Kolybabi " license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"safe", "discovery"} --- TODO: Add 5684 "coaps" if DTLS support is added -portrule = shortport.port_or_service(5683, "coap", "udp") +portrule = shortport.port_or_service({5683, 5684}, {"coap", "coaps"}, "udp") format_payload = function(payload) -- Leave strings alone. diff --git a/scripts/ftp-anon.nse b/scripts/ftp-anon.nse index 50274b547..e7198337a 100644 --- a/scripts/ftp-anon.nse +++ b/scripts/ftp-anon.nse @@ -1,7 +1,6 @@ local ftp = require "ftp" local match = require "match" local nmap = require "nmap" -local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local table = require "table" @@ -38,7 +37,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "auth", "safe"} -portrule = shortport.port_or_service({21,990}, {"ftp","ftps"}) +portrule = ftp.portrule -- --------------------- -- Directory listing function. diff --git a/scripts/ftp-bounce.nse b/scripts/ftp-bounce.nse index cb5476f98..f15273b73 100644 --- a/scripts/ftp-bounce.nse +++ b/scripts/ftp-bounce.nse @@ -1,5 +1,4 @@ local nmap = require "nmap" -local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local ftp = require "ftp" @@ -29,7 +28,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "safe"} -portrule = shortport.port_or_service({21, 990}, {"ftp", "ftps"}) +portrule = ftp.portrule local function get_portfmt() local arghost = stdnse.get_script_args(SCRIPT_NAME .. ".checkhost") or "scanme.nmap.org" diff --git a/scripts/ftp-brute.nse b/scripts/ftp-brute.nse index ae91ed1ce..36c1f5ff7 100644 --- a/scripts/ftp-brute.nse +++ b/scripts/ftp-brute.nse @@ -1,6 +1,5 @@ local brute = require "brute" local creds = require "creds" -local shortport = require "shortport" local stdnse = require "stdnse" local ftp = require "ftp" @@ -37,7 +36,7 @@ author = "Aleksandar Nikolic" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"intrusive", "brute"} -portrule = shortport.port_or_service(21, "ftp") +portrule = ftp.portrule local arg_timeout = stdnse.parse_timespec(stdnse.get_script_args(SCRIPT_NAME .. ".timeout")) arg_timeout = (arg_timeout or 5) * 1000 diff --git a/scripts/ftp-libopie.nse b/scripts/ftp-libopie.nse index c5dfd147a..effe258b8 100644 --- a/scripts/ftp-libopie.nse +++ b/scripts/ftp-libopie.nse @@ -37,7 +37,7 @@ author = "Ange Gutek" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"vuln","intrusive"} - +-- TODO: use comm.lua or ftp.lua and add ftps portrule = shortport.port_or_service(21, "ftp") action = function(host, port) diff --git a/scripts/ftp-proftpd-backdoor.nse b/scripts/ftp-proftpd-backdoor.nse index 95fc6701d..7217b2f38 100644 --- a/scripts/ftp-proftpd-backdoor.nse +++ b/scripts/ftp-proftpd-backdoor.nse @@ -1,6 +1,5 @@ local ftp = require "ftp" local nmap = require "nmap" -local shortport = require "shortport" local stdnse = require "stdnse" -- -*- mode: lua -*- @@ -48,7 +47,7 @@ portrule = function (host, port) return false end - return shortport.port_or_service(21, "ftp")(host, port) + return ftp.portrule(host, port) end action = function(host, port) diff --git a/scripts/ftp-syst.nse b/scripts/ftp-syst.nse index af9a18b7d..b48730129 100644 --- a/scripts/ftp-syst.nse +++ b/scripts/ftp-syst.nse @@ -1,5 +1,4 @@ local ftp = require "ftp" -local shortport = require "shortport" local stdnse = require "stdnse" description = [[ @@ -63,7 +62,7 @@ categories = {"default", "discovery", "safe"} -- No data connection -- End of status -portrule = shortport.port_or_service({21,990}, {"ftp","ftps"}) +portrule = ftp.portrule local function do_syst(socket, buffer) end diff --git a/scripts/ftp-vsftpd-backdoor.nse b/scripts/ftp-vsftpd-backdoor.nse index 6b79df85f..00ff0a37b 100644 --- a/scripts/ftp-vsftpd-backdoor.nse +++ b/scripts/ftp-vsftpd-backdoor.nse @@ -1,6 +1,5 @@ local ftp = require "ftp" local nmap = require "nmap" -local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local table = require "table" @@ -68,7 +67,7 @@ portrule = function (host, port) return false end - return shortport.port_or_service(21, "ftp")(host, port) + return ftp.portrule(host, port) end local function finish_ftp(socket, status, message) diff --git a/scripts/ftp-vuln-cve2010-4221.nse b/scripts/ftp-vuln-cve2010-4221.nse index c02a99664..850368fc2 100644 --- a/scripts/ftp-vuln-cve2010-4221.nse +++ b/scripts/ftp-vuln-cve2010-4221.nse @@ -1,5 +1,4 @@ local ftp = require "ftp" -local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local stringaux = require "stringaux" @@ -54,7 +53,7 @@ portrule = function (host, port) if port.version.product ~= nil and port.version.product ~= "ProFTPD" then return false end - return shortport.port_or_service(21, "ftp")(host, port) + return ftp.portrule(host, port) end local function get_proftpd_banner(banner) diff --git a/scripts/http-csrf.nse b/scripts/http-csrf.nse index 9a8f87906..1b81b4b40 100644 --- a/scripts/http-csrf.nse +++ b/scripts/http-csrf.nse @@ -57,7 +57,7 @@ local table = require "table" local string = require "string" local httpspider = require "httpspider" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http -- Checks if this is really a token. isToken = function(value) diff --git a/scripts/http-devframework.nse b/scripts/http-devframework.nse index ce0f1aee2..e655d7b82 100644 --- a/scripts/http-devframework.nse +++ b/scripts/http-devframework.nse @@ -48,7 +48,7 @@ local stdnse = require "stdnse" local httpspider = require "httpspider" local _G = require "_G" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http local function loadFingerprints(filename) diff --git a/scripts/http-dombased-xss.nse b/scripts/http-dombased-xss.nse index 18eaf9082..f8f4a0ed8 100644 --- a/scripts/http-dombased-xss.nse +++ b/scripts/http-dombased-xss.nse @@ -67,7 +67,7 @@ JS_CALLS_PATTERNS = { 'location', } -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http action = function(host, port) diff --git a/scripts/http-domino-enum-passwords.nse b/scripts/http-domino-enum-passwords.nse index 81be8feb4..ec503b3d7 100644 --- a/scripts/http-domino-enum-passwords.nse +++ b/scripts/http-domino-enum-passwords.nse @@ -90,7 +90,7 @@ categories = {"intrusive", "auth"} dependencies = {"http-brute", "http-form-brute"} -portrule = shortport.port_or_service({80, 443}, {"http","https"}, "tcp", "open") +portrule = shortport.http --- Checks if the path require authentication -- diff --git a/scripts/http-errors.nse b/scripts/http-errors.nse index 4907d2e73..b13d16c79 100644 --- a/scripts/http-errors.nse +++ b/scripts/http-errors.nse @@ -42,7 +42,7 @@ local stdnse = require "stdnse" local table = require "table" local httpspider = require "httpspider" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http local function compare(a, b) return a[1] < b[1] diff --git a/scripts/http-feed.nse b/scripts/http-feed.nse index 57fc18709..398ee8e29 100644 --- a/scripts/http-feed.nse +++ b/scripts/http-feed.nse @@ -33,7 +33,7 @@ local table = require "table" local string = require "string" local httpspider = require "httpspider" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http FEEDS = { RSS = { search = { '' }, version = 'version=["\'](.-)["\']' }, Atom = { search = { '' }, version = 'version=["\'](.-)["\']' }, diff --git a/scripts/http-fileupload-exploiter.nse b/scripts/http-fileupload-exploiter.nse index b771ae920..cf5b8226b 100644 --- a/scripts/http-fileupload-exploiter.nse +++ b/scripts/http-fileupload-exploiter.nse @@ -63,7 +63,7 @@ local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http -- A list of payloads. The interpreted code in the 'content' variable should diff --git a/scripts/http-form-brute.nse b/scripts/http-form-brute.nse index ce3a4b0db..3f8c74484 100644 --- a/scripts/http-form-brute.nse +++ b/scripts/http-form-brute.nse @@ -109,7 +109,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"intrusive", "brute"} -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http -- Miscellaneous script-wide constants diff --git a/scripts/http-mobileversion-checker.nse b/scripts/http-mobileversion-checker.nse index 6d2c5563d..b5821b0c5 100644 --- a/scripts/http-mobileversion-checker.nse +++ b/scripts/http-mobileversion-checker.nse @@ -57,7 +57,7 @@ getLastLoc = function(host, port, useragent) end -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http action = function(host, port) diff --git a/scripts/http-qnap-nas-info.nse b/scripts/http-qnap-nas-info.nse index b46fd4d6b..4cfe16320 100644 --- a/scripts/http-qnap-nas-info.nse +++ b/scripts/http-qnap-nas-info.nse @@ -47,7 +47,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"safe","discovery"} -portrule = shortport.port_or_service ({443,8080}, "https", "tcp") +portrule = shortport.http action = function(host, port) diff --git a/scripts/http-referer-checker.nse b/scripts/http-referer-checker.nse index 6a56423b7..a82ed5fe1 100644 --- a/scripts/http-referer-checker.nse +++ b/scripts/http-referer-checker.nse @@ -29,7 +29,7 @@ local stdnse = require "stdnse" local table = require "table" local httpspider = require "httpspider" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http action = function(host, port) diff --git a/scripts/http-rfi-spider.nse b/scripts/http-rfi-spider.nse index 1d0504902..132007af7 100644 --- a/scripts/http-rfi-spider.nse +++ b/scripts/http-rfi-spider.nse @@ -177,7 +177,7 @@ local function check_responses(urls, responses) return suspects end -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http function action(host, port) inclusion_url = stdnse.get_script_args('http-rfi-spider.inclusionurl') or 'http://tools.ietf.org/html/rfc13?' diff --git a/scripts/http-security-headers.nse b/scripts/http-security-headers.nse index 17329ffc9..dbb3c69a7 100644 --- a/scripts/http-security-headers.nse +++ b/scripts/http-security-headers.nse @@ -96,7 +96,7 @@ author = {"Icaro Torres", "Vinamra Bhatia"} license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"discovery", "safe"} -portrule = shortport.port_or_service({80,443}, "http", "tcp") +portrule = shortport.http local function fail (err) return stdnse.format_output(false, err) end diff --git a/scripts/http-sitemap-generator.nse b/scripts/http-sitemap-generator.nse index bb2f8f5a3..ae98e35ba 100644 --- a/scripts/http-sitemap-generator.nse +++ b/scripts/http-sitemap-generator.nse @@ -54,7 +54,7 @@ local httpspider = require 'httpspider' local string = require 'string' local table = require 'table' -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http local function dict_add(d, k, v) if not d[k] then diff --git a/scripts/http-sql-injection.nse b/scripts/http-sql-injection.nse index 84f446032..3dfb95882 100644 --- a/scripts/http-sql-injection.nse +++ b/scripts/http-sql-injection.nse @@ -61,7 +61,7 @@ categories = {"intrusive", "vuln"} -- -portrule = shortport.port_or_service({80, 443}, {"http","https"}) +portrule = shortport.http --[[ Pattern match response from a submitted injection query to see diff --git a/scripts/http-stored-xss.nse b/scripts/http-stored-xss.nse index c0591d5b7..ff582f2af 100644 --- a/scripts/http-stored-xss.nse +++ b/scripts/http-stored-xss.nse @@ -65,7 +65,7 @@ local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http -- A list of payloads. diff --git a/scripts/http-useragent-tester.nse b/scripts/http-useragent-tester.nse index d6e0acabc..9b9331a15 100644 --- a/scripts/http-useragent-tester.nse +++ b/scripts/http-useragent-tester.nse @@ -105,7 +105,7 @@ getLastLoc = function(host, port, useragent) end -portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") +portrule = shortport.http action = function(host, port) diff --git a/scripts/telnet-brute.nse b/scripts/telnet-brute.nse index 88f5f972d..c35412d3f 100644 --- a/scripts/telnet-brute.nse +++ b/scripts/telnet-brute.nse @@ -34,7 +34,7 @@ author = "nnposter" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {'brute', 'intrusive'} -portrule = shortport.port_or_service(23, 'telnet') +portrule = shortport.port_or_service({23, 992}, {'telnet', 'telnets'}) -- Miscellaneous script-wide parameters and constants diff --git a/scripts/telnet-ntlm-info.nse b/scripts/telnet-ntlm-info.nse index c1d36c52e..f4b7facbb 100644 --- a/scripts/telnet-ntlm-info.nse +++ b/scripts/telnet-ntlm-info.nse @@ -75,13 +75,13 @@ local tnap_login_packet = string.pack("