blob: 80b77c95abb65c6acb1ef530966d739168d0611d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
description = [[
Decodes any unencrypted F5 BIG-IP cookies in the HTTP response.
BIG-IP cookies contain information on backend systems such as
internal IP addresses and port numbers.
See here for more info: https://support.f5.com/csp/article/K6917
]]
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
---
-- @usage
-- nmap -p <port> --script http-bigip-cookie <target>
--
-- @output
-- PORT STATE SERVICE
-- 80/tcp open http
-- | http-bigip-cookie:
-- | BIGipServer<pool_name>:
-- | address:
-- | host: 10.1.1.100
-- | type: ipv4
-- |_ port: 8080
--
-- @xmloutput
-- <table key="BIGipServer<pool_name>">
-- <table key="address">
-- <elem key="host">10.1.1.100</elem>
-- <elem key="type">ipv4</elem>
-- </table>
-- <elem key="port">8080</elem>
-- </table>
--
-- @args http-bigip-cookie.path The URL path to request. The default path is "/".
author = "Seth Jackson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "discovery", "safe" }
portrule = shortport.http
action = function(host, port)
local path = stdnse.get_script_args(SCRIPT_NAME..".path") or "/"
local response = http.get(host, port, path, { redirect_ok = false })
if not response then
return
end
if not response.cookies then
return
end
local output = stdnse.output_table()
for _, cookie in ipairs(response.cookies) do
if cookie.name:find("BIGipServer") then
local host, port = cookie.value:match("^(%d+)%.(%d+)%.")
if host and tonumber(host) < 0x100000000 and tonumber(port) < 0x10000 then
host = table.concat({("BBBB"):unpack(("<I4"):pack(host))}, ".", 1, 4)
port = (">I2"):unpack(("<I2"):pack(port))
local result = {
address = {
host = host,
type = "ipv4"
},
port = port
}
output[cookie.name] = result
end
end
end
if #output > 0 then
return output
end
end
|
