blob: 111bf657aa91932ed3636a9685a35655eb402c75 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
description = [[
Determines if a ASP.NET application has debugging enabled using a HTTP DEBUG request.
The HTTP DEBUG verb is used within ASP.NET applications to start/stop remote
debugging sessions. The script sends a 'stop-debug' command to determine the
application's current configuration state but access to RPC services is required
to interact with the debugging session. The request does not change the
application debugging configuration.
]]
---
-- @usage nmap --script http-aspnet-debug <target>
-- @usage nmap --script http-aspnet-debug --script-args http-aspnet-debug.path=/path <target>
--
-- @args http-aspnet-debug.path Path to URI. Default: /
--
-- @output
-- 80/tcp open http syn-ack
-- | http-aspnet-debug:
-- |_ status: DEBUG is enabled
--
-- @xmloutput
-- <elem key="status">DEBUG is enabled</elem>
---
author = "Josh Amishav-Zlatin"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "vuln", "discovery" }
portrule = shortport.http
local function generate_http_debug_req(host, port, path)
local status = false
local options = {header={}}
options["header"]["Command"] = "stop-debug"
options["redirect_ok"] = 2
-- send DEBUG request with stop-debug command
local req = http.generic_request(host, port, "DEBUG", path, options)
stdnse.debug1("Response body: %s", req.body )
if req.body:match("OK") then
status = true
end
return status
end
action = function(host, port)
local output = stdnse.output_table()
local path = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/"
local status = generate_http_debug_req(host, port, path)
if status then
output.status = "DEBUG is enabled"
return output
end
end
|
