1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
local http = require "http"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
description = [[
Sends an HTTP TRACE request and shows if the method TRACE is enabled. If debug
is enabled, it returns the header fields that were modified in the response.
]]
---
-- @usage
-- nmap --script http-trace -d <ip>
--
-- @output
-- 80/tcp open http syn-ack
-- | http-trace: TRACE is enabled
-- | Headers:
-- | Date: Tue, 14 Jun 2011 04:41:28 GMT
-- | Server: Apache
-- | Connection: close
-- | Transfer-Encoding: chunked
-- |_Content-Type: message/http
--
-- @args http-trace.path Path to URI
author = "Paulino Calderon <calderon@websec.mx>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "discovery", "safe"}
portrule = shortport.http
--- Validates the HTTP response and returns header list
--@param response The HTTP response
--@param response_headers The HTTP response headers
local validate = function(response, response_headers)
local output_lines = {}
if ( not(response) ) then
return
end
if not(response:match("HTTP/1.[01] 200") or response:match("TRACE / HTTP/1.[01]")) then
return
else
output_lines[ #output_lines+1 ] = "TRACE is enabled"
end
if nmap.verbosity() >= 2 then
output_lines[ #output_lines+1 ]= "Headers:"
for _, value in pairs(response_headers) do
output_lines [ #output_lines+1 ] = value
end
end
if #output_lines > 0 then
return table.concat(output_lines, "\n")
end
end
---
--MAIN
---
action = function(host, port)
local path = stdnse.get_script_args("http-trace.path") or "/"
local req = http.generic_request(host, port, "TRACE", path)
if (req.status == 301 or req.status == 302) and req.header["location"] then
req = http.generic_request(host, port, "TRACE", req.header["location"])
end
return validate(req.body, req.rawheader)
end
|
