Changeset 293

Timestamp:

01/29/10 05:25:15 (3 years ago)

Author:

sullo

Message:

Ticket 117: Fixed SKIPPORTS
Minor cleanups

Location:

trunk

Files:

• docs/CHANGES.txt (modified) (3 diffs)
• nikto.conf (modified) (2 diffs)
• plugins/db_outdated (modified) (1 diff)
• plugins/nikto_core.plugin (modified) (1 diff)

trunk/docs/CHANGES.txt

@@ -1 +1 @@
 2010-01-20 Nikto 2.1.1
-        - Moved User-Agent string to nikto.conf
-        - Added dynamic variables to User-Agent (Testid, Evasion methods)
-        - Reporting: simplify xml/html code, fix a bug when a space is in the uri, and load ony needed templates
-        - Enable 2 new LW evasion tacticts (carriage return or binary value as request spacer)
-        - Ticket  95: Added support for OSVDB, now the fun bit of filling it in
+        - Ticket 117: Fixed SKIPPORTS
+        - Ticket 116: Moved User-Agent string to nikto.conf
+        - Ticket 116: Added dynamic variables to User-Agent (Testid, Evasion methods)
+        - Ticket 95: Added support for OSVDB, now the fun bit of filling it in
         - Ticket 111: Basic syntax checks for all databases
         - Ticket 109: Added an extra optional <ssl /> element to xml output to contain the SSL date. Need to do similar for html, txt and csv
@@ -10 +9 @@
         - Ticket 107: Support for short reads in LW2.5
         - Ticket 98: If -Format is missed guess the format based on file extension in -output. Default is none if -output is omitted.
-        - Added support to select plugins via -Plugins and -list-plugins option to list current plugins
-        - Major bug fix for proxy usage
         - Ticket 96: Multiple index file enhancements for groups and better unique file identification
         - Ticket 103: <description> content in xml report is now wrapped in CDATA 
@@ -17 +14 @@
         - Ticket 97: Fix for response caching
         - Ticket 99: Spelling disagreements between Brits and Americans
+        - Removed NMAP and NMAPOPTS from nikto.conf as it is no longer used/supported
+        - Reporting: simplify xml/html code, fix a bug when a space is in the uri, and load ony needed templates
+        - Enable 2 new LW evasion tacticts (carriage return or binary value as request spacer)
+        - Added support to select plugins via -Plugins and -list-plugins option to list current plugins
+        - Major bug fix for proxy usage
         - Don't report p3p header as unusual
         - Various changes to aid future binary db usage for mutates

trunk/nikto.conf

@@ -7 +7 @@
 NIKTODTD=docs/nikto.dtd
 
-# location of nmap to use with port scanning (rather than Nikto internals)
-# and any options to pass to it
-NMAP=/usr/local/bin/nmap
-NMAPOPTS=-P0
-
 # ports never to scan
-#SKIPPORTS=21 111
+SKIPPORTS=21 111
 
 # User-Agent variables:
- # @VERSION - Nikto version
- # @TESTID - Test identifier
- # @EVASIONS - List of active evasions
-USERAGENT="Mozilla/4.75 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID)";
+ # @VERSION     - Nikto version
+ # @TESTID      - Test identifier
+ # @EVASIONS    - List of active evasions
+USERAGENT=Mozilla/4.75 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID)
 
 # IDs never to alert on (Note: this only works for IDs loaded from db_tests)
@@ -33 +28 @@
 # send updates because it makes the data better for everyone ;)  *NO* server specific information
 # such as IP or name is sent, just the relevant version information.
-# UPDATES=yes  #-- ask before each submission if it should send
-# UPDATES=no   #-- don't ask, don't send
-# UPDATES=auto #-- automatically attempt submission *without prompting*
+# UPDATES=yes   - ask before each submission if it should send
+# UPDATES=no    - don't ask, don't send
+# UPDATES=auto  - automatically attempt submission *without prompting*
 UPDATES=yes
 

trunk/plugins/db_outdated

@@ -388 +388 @@
 "600374","Microsoft_PWS_Mac/","4.0b1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)"
 "600375","Microsoft-HTTPAPI/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)"
-"600376","Microsoft-IIS/","6.0","@RUNNING_VER appears to be outdated (4.0 for NT 4, 5.0 for Win2k, current is at least @CURRENT_VER)"
+"600376","Microsoft-IIS/","7.0","@RUNNING_VER appears to be outdated (4.0 for NT 4, 5.0 for Win2k, current is at least @CURRENT_VER)"
 "600377","Microsoft-Internet-Information-Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)"
 "600378","Microsoft-PWS-95/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)"

trunk/plugins/nikto_core.plugin

@@ -1200 +1200 @@
    my ($hostname, $ip, $port) = @_;
    my (%m, %headers);
+
+   # Check SKIPPORTS
+   if ($NIKTOCONFIG{'SKIPPORTS'} =~ /\b$port\b/) {
+        nprint("+ ERROR: SKIPPORTS (nikto.conf) contains $port -- not checking");
+        return 0;
+        }
 
    $m->{hostname}=$hostname;