CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove TRACE from the http-methods.nse "uninteresting" set on a

Browse source 
recommendation from Daniel Roethlisberger. TRACE is interesting because
it can be used to get cookies or authentication data in a cross-site
scripting attack. See http://www.owasp.org/index.php/Cross_Site_Tracing.
This commit is contained in:
david 2010-02-22 21:42:47 +00:00
parent a67be3d7d1
commit e603eadd96
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/http-methods.nse
View file

@ -6,8 +6,8 @@ HTTP methods are allowed on this server. Optionally tests each method
individually to see if they are subject to e.g. IP address restrictions.
By default, the script will not report anything if the only methods
found are GET, HEAD, POST, OPTIONS, or TRACE. If any other methods are
found, or if Nmap is run in verbose mode, then all of them are reported.
found are GET, HEAD, POST, or OPTIONS. If any other methods are found,
or if Nmap is run in verbose mode, then all of them are reported.
]]
---
@ -43,7 +43,7 @@ require("stdnse")
-- We don't report these methods except with verbosity.
local UNINTERESTING_METHODS = {
"GET", "HEAD", "POST", "OPTIONS", "TRACE"
"GET", "HEAD", "POST", "OPTIONS"
}
local filter_out