Nmap Development mailing list archives
Re: [NSE] HTTP TRACE script
From: Kris Katterjohn <katterjohn () gmail com>
Date: Sat, 01 Sep 2007 12:27:02 -0500
I wrote:
I've attached an NSE script which sends an HTTP TRACE command to a server and examines the response for modifications.
In what Brandon calls poor form, I'm replying to myself:I missed something that never came up in initial testing, but showed up twice in one scan (-iR 5000) this morning: a host sending a 200 OK, but actually being a 400-level error HTML message with no trace.
After rescanning the guilty hosts with the attached script and using --script-trace, it seems to work fine.
I attached the copy so you can test it out without patching, but here's the diff:
--- HTTPtrace.nse 2007-09-01 12:11:42.000000000 -0500 +++ HTTPtrace.nse 2007-09-01 11:52:56.000000000 -0500 @@ -17,7 +17,8 @@ validate = function(response, original) local start, stop local data - if not string.match(response, "HTTP/1.[01] 200") then + if not string.match(response, "HTTP/1.[01] 200") or + not string.match(response, "TRACE / HTTP/1.0") then return end Please let me know what you think! Thanks, Kris Katterjohn
-- Send HTTP TRACE command and check for modifications -- 08/31/2007 id = "HTTP TRACE" description = "Send HTTP TRACE and check for modifications" author = "Kris Katterjohn <katterjohn () gmail com>" license = "Look at Nmap's COPYING" categories = {"safe", "discovery"} require "shortport" validate = function(response, original) local start, stop local data if not string.match(response, "HTTP/1.[01] 200") or not string.match(response, "TRACE / HTTP/1.0") then return end start, stop = string.find(response, "\r\n\r\n") data = string.sub(response, stop+1) if original ~= data then return data end return end portrule = shortport.port_or_service({80, 8080}, "http") action = function(host, port) local cmd, response, ret local socket socket = nmap.new_socket() socket:connect(host.ip, port.number) cmd = "TRACE / HTTP/1.0\r\n\r\n" socket:send(cmd) response = "" while true do local status, lines = socket:receive_lines(1) if not status then break end response = response .. lines end socket:close() ret = validate(response, cmd) if ret then local output = "" output = output .. "Response differs from request:\n" output = output .. "Sent:\n" .. cmd .. "\n" output = output .. "Received:\n" .. ret .. "\n" return output end return end
_______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://SecLists.Org
Current thread:
- [NSE] HTTP TRACE script Kris Katterjohn (Aug 31)
- Re: [NSE] HTTP TRACE script Kris Katterjohn (Sep 01)
- Re: [NSE] HTTP TRACE script Kris Katterjohn (Sep 01)
- Re: [NSE] HTTP TRACE script Kris Katterjohn (Sep 01)