mirror of
https://github.com/nmap/nmap.git
synced 2026-08-27 03:48:14 +00:00
o Added NSE HTTP library which allows scripts to easily fetch URLs
with http.get_url() or create more complex requests with http.request(). There is also an http.get() function which takes components (hostname, port, and path) rather than a URL. The HTTPAuth, robots, and showHTMLTitle NSE scripts have been updated to use this library. Sven Klemm wrote all of this code.
This commit is contained in:
fyodor
parent
5220e7382a
commit
9cf7f14afe
4 changed files with 57 additions and 164 deletions
|
|
@ -14,121 +14,52 @@ license = "See nmaps COPYING for licence"
|
|||
categories = {"intrusive"}
|
||||
|
||||
require "shortport"
|
||||
require "http"
|
||||
|
||||
portrule = shortport.port_or_service({80, 8080}, "http")
|
||||
portrule = shortport.port_or_service({80, 443, 8080}, {"http","https"})
|
||||
|
||||
action = function(host, port)
|
||||
local socket
|
||||
local catch = function()
|
||||
socket:close()
|
||||
end
|
||||
local realm,scheme,result
|
||||
local basic = false
|
||||
|
||||
local try = nmap.new_try(catch)
|
||||
local answer = http.get( host, port, "/" )
|
||||
|
||||
local get_http_headers = function(dst, dst_port, query_string)
|
||||
socket = nmap.new_socket()
|
||||
--- check for 401 response code
|
||||
if answer.status == 401 then
|
||||
result = "HTTP Service requires authentication\n"
|
||||
|
||||
try(socket:connect(dst, dst_port))
|
||||
try(socket:send(query_string))
|
||||
-- split www-authenticate header
|
||||
local auth_headers = {}
|
||||
local pcre = pcre.new('\\w+( (\\w+=("[^"]+"|\\w+), *)*(\\w+=("[^"]+"|\\w+)))?',0,"C")
|
||||
local match = function( match ) table.insert(auth_headers, match) end
|
||||
pcre:gmatch( answer.header['www-authenticate'], match )
|
||||
|
||||
local response = ""
|
||||
local lines
|
||||
local status
|
||||
for _, value in pairs( auth_headers ) do
|
||||
result = result .. " Auth type: "
|
||||
scheme, realm = string.match(value, "(%a+).-[Rr]ealm=\"(.-)\"")
|
||||
if scheme == "Basic" then
|
||||
basic = true
|
||||
end
|
||||
if realm ~= nil then
|
||||
result = result .. scheme .. ", realm = " .. realm .. "\n"
|
||||
else
|
||||
result = result .. string.match(value, "(%a+)") .. "\n"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
while true do
|
||||
status, lines = socket:receive_lines(1)
|
||||
if basic then
|
||||
answer = http.get(host, port, '/', {header={Authorization="Basic YWRtaW46C"}})
|
||||
if answer.status ~= 401 and answer.status ~= 403 then
|
||||
result = result .. " HTTP server may accept user=\"admin\" with blank password for Basic authentication\n"
|
||||
end
|
||||
|
||||
if not status then
|
||||
break
|
||||
end
|
||||
answer = http.get(host, port, '/', {header={Authorization="Basic YWRtaW46YWRtaW4"}})
|
||||
if answer.status ~= 401 and answer.status ~= 403 then
|
||||
result = result .. " HTTP server may accept user=\"admin\" with password=\"admin\" for Basic authentication\n"
|
||||
end
|
||||
end
|
||||
|
||||
response = response .. lines
|
||||
end
|
||||
|
||||
try(socket:close())
|
||||
|
||||
local tags = {"(.-)<![Dd][Oo][Cc][Tt][Yy][Pp][Ee]", "(.-)<[Hh][Tt][Mm][Ll]", "(.-)<[Hh][Ee][Aa][Dd]", "(.-)<[Bb][Oo][Dd][Yy]"}
|
||||
local hdrs
|
||||
|
||||
for I = 1, #tags do
|
||||
hdrs = string.match(response, tags[I])
|
||||
if hdrs ~= nil and hdrs ~= response and hdrs ~= "" then
|
||||
return hdrs
|
||||
end
|
||||
end
|
||||
|
||||
return response
|
||||
end
|
||||
|
||||
local auth
|
||||
local value
|
||||
local realm
|
||||
local scheme
|
||||
local result
|
||||
local basic = false
|
||||
|
||||
local query = "GET / HTTP/1.1\r\n"
|
||||
query = query .. "Accept: */*\r\n"
|
||||
query = query .. "Accept-Language: en\r\n"
|
||||
query = query .. "User-Agent: Nmap NSE\r\n"
|
||||
query = query .. "Connection: close\r\n"
|
||||
query = query .. "Host: " .. host.ip .. ":" .. port.number .. "\r\n\r\n"
|
||||
|
||||
local headers = get_http_headers(host.ip, port.number, query)
|
||||
|
||||
--- check for 401 response code
|
||||
auth = string.match(headers, "HTTP/1.- 401")
|
||||
if auth ~= nil then
|
||||
result = "HTTP Service requires authentication\n"
|
||||
-- loop through any WWW-Authenticate: headers to determine valid authentication schemes
|
||||
for value in string.gmatch(headers, "[Aa]uthenticate:(.-)\n") do
|
||||
result = result .. " Auth type: "
|
||||
scheme, realm = string.match(value, "(%a+).-[Rr]ealm=\"(.-)\"")
|
||||
if scheme == "Basic" then
|
||||
basic = true
|
||||
end
|
||||
if realm ~= nil then
|
||||
result = result .. scheme .. ", realm = " .. realm .. "\n"
|
||||
else
|
||||
result = result .. string.match(value, "(%a+)") .. "\n"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if basic then
|
||||
query = "GET / HTTP/1.1\r\n"
|
||||
query = query .. "Authorization: Basic YWRtaW46C\r\n"
|
||||
query = query .. "Accept: */*\r\n"
|
||||
query = query .. "Accept-Language: en\r\n"
|
||||
query = query .. "User-Agent: Nmap NSE\r\n"
|
||||
query = query .. "Connection: close\r\n"
|
||||
query = query .. "Host: " .. host.ip .. ":" .. port.number .. "\r\n\r\n"
|
||||
|
||||
auth = ""
|
||||
headers = get_http_headers(host.ip, port.number, query)
|
||||
|
||||
auth = string.match(headers, "HTTP/1.- 40[013]")
|
||||
if auth == nil then
|
||||
result = result .. " HTTP server may accept user=\"admin\" with blank password for Basic authentication\n"
|
||||
end
|
||||
|
||||
query = "GET / HTTP/1.1\r\n"
|
||||
query = query .. "Authorization: Basic YWRtaW46YWRtaW4\r\n"
|
||||
query = query .. "Accept: */*\r\n"
|
||||
query = query .. "Accept-Language: en\r\n"
|
||||
query = query .. "User-Agent: Nmap NSE\r\n"
|
||||
query = query .. "Connection: close\r\n"
|
||||
query = query .. "Host: " .. host.ip .. ":" .. port.number .. "\r\n\r\n"
|
||||
|
||||
auth = ""
|
||||
headers = get_http_headers(host.ip, port.number, query)
|
||||
|
||||
auth = string.match(headers, "HTTP/1.- 40[013]")
|
||||
if auth == nil then
|
||||
result = result .. " HTTP server may accept user=\"admin\" with password=\"admin\" for Basic authentication\n"
|
||||
end
|
||||
end
|
||||
|
||||
return result
|
||||
return result
|
||||
end
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue