diff options
Diffstat (limited to '')
-rw-r--r-- | scripts/http-cors.nse | 100 |
1 files changed, 100 insertions, 0 deletions
diff --git a/scripts/http-cors.nse b/scripts/http-cors.nse new file mode 100644 index 0000000..e766a3a --- /dev/null +++ b/scripts/http-cors.nse @@ -0,0 +1,100 @@ +local http = require "http" +local nmap = require "nmap" +local shortport = require "shortport" +local stringaux = require "stringaux" +local table = require "table" + +description = [[ +Tests an http server for Cross-Origin Resource Sharing (CORS), a way +for domains to explicitly opt in to having certain methods invoked by +another domain. + +The script works by setting the Access-Control-Request-Method header +field for certain enumerated methods in OPTIONS requests, and checking +the responses. +]] + +--- +-- @args http-cors.path The path to request. Defaults to +-- <code>/</code>. +-- +-- @args http-cors.origin The origin used with requests. Defaults to +-- <code>example.com</code>. +-- +-- @usage +-- nmap -p 80 --script http-cors <target> +-- +-- @output +-- 80/tcp open +-- |_cors.nse: GET POST OPTIONS + + +author = "Toni Ruottu" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" +categories = {"default", "discovery", "safe"} + + +portrule = shortport.http + +local methods = {"HEAD", "GET", "POST", "PUT", "DELETE", "TRACE", "OPTIONS", "CONNECT", "PATCH"} + +local function origin_ok(raw, origin) + if not raw then + return false + end + if raw == "*" then + return true + end + if raw == "null" then + return false + end + local allowed = stringaux.strsplit(" ", raw) + for _, ao in ipairs(allowed) do + if origin == ao then + return true + end + end + return false +end + +local function method_ok(raw, method) + if not raw then + return false + end + local stuff = stringaux.strsplit(" ", raw) + local nospace = table.concat(stuff, "") + local allowed = stringaux.strsplit(",", nospace) + for _, am in ipairs(allowed) do + if method == am then + return true + end + end + return false +end + +local function test(host, port, method, origin) + local header = { + ["Origin"] = origin, + ["Access-Control-Request-Method"] = method, + } + local response = http.generic_request(host, port, "OPTIONS", "/", {header = header}) + local aorigins = response.header["access-control-allow-origin"] + local amethods = response.header["access-control-allow-methods"] + local ook = origin_ok(aorigins, response) + local mok = method_ok(amethods, method) + return ook and mok +end + +action = function(host, port) + local path = nmap.registry.args["http-cors.path"] or "/" + local origin = nmap.registry.args["http-cors.origin"] or "example.com" + local allowed = {} + for _, method in ipairs(methods) do + if test(host, port, method, origin) then + table.insert(allowed, method) + end + end + if #allowed > 0 then + return table.concat(allowed, " ") + end +end |